One key to check on Windows boxen is the Run key. The run key is located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. When a user logs on, the programs specified in the run key also run. Many times a trojan will install itself here. A lesser evil is the hordes of small little apps that like to run some silly little agent. You’ll find them lurking in this key as well. It is good practice to peek at this key and see what is starting up. For more info on this and other similar keys for various Windows platforms, see this article.