hey chickenhawk,
a firewall wont help you - it operates at the network layer, not the application layer.
it might be able to log what network traffic is trudging it's way around your segment of the network, but that will not necessarily help you.
also, firewalls usually don't block outgoing connections, as it's really only incoming connections that are malicious.
my advice is to install Mike Lin's control panel as linked to in my post above... it will tell you exactly what is being run on startup and how it is being run (startup folder, several registry hives, etc)
hope this helps - please do let me know how you go <img src="smile.gif" border="0">
regards,. .-marc.