Netstat -an will give you connections established, hopefully nothing from the outside 

procexp.exe will give you a list of running processes, check out extraneous or if you have been done over they could using a system process to cloak there access.

What about another question, do you need netbios on your network, can you close this and other ports, is this in the DMZ, if it is close everything you can to reduce your attack vectors:

Port 139 (TCP) and Port 137 (UDP)

This is closed by following the following procedure:

•   Right click My Network Places
•   Select properties
•   Double-click Local area connection
•   Click Properties
•   Double click TCP/IP Connections
•   Click advanced
•   Click WINS
•   Tick disable NetBIOS over TCP/IP


For extra security, you should also deselect file and printer sharing on the Local area connection main page, general tab

Port 445

Port 445 can be disabled on the host by using the following instructions :

•   Select Start
•   Select Run
•   Type in Regedt32
•   Locate the following key in the registry:

o   HKLM\System\CurrentControlSet\Services\NetBT\Parameters

•   Double-click on the key TransportBindName.
•   Delete the value (\Device\), and leave the box blank.

•   Close the Registry Editor
•   Reboot your computer.

TCP Port 445 is now closed.  This can be confirmed on the localhost by running the netstat command

Port 135 (TCP)

RPC services can't be disabled but the parameters referencing the listening interfaces can be modified to bind this port to the localhost (127.0.0.1) and thus disallow access from external connections :

•   Create a registry key file with the following contents:

-------------------------- cut here -----------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rpc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rpc\Linkage]
"Bind"=hex(7):31,00,00,00,00,00

-------------------------- cut here ------------------------------

•   Save as 135.reg
•   Double-click 135.reg

The keys are now written to the registry.

By default RPC listens on all network interfaces, this can be modified by creating the following Registry key and string (ListenOnInternet REG_SZ = N
) at the following location:

•   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs

When this value is set to N (NO)  the port 135 is listening only on interfaces listed in the value "Bind"=1 which correspond to 127.0.0.1 the localhost.
(or MS TCP Loopback interface)

Disable DCOM

This is achieved by setting the following string (EnableDCOM Reg_Sz = N) in the registry key:

•   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole

Reboot the machine.

Port 135 is now bound to localhost. This can be confirmed on the localhost by running the netstat command

Just locked down a 2K3 server with this and lots of other tweaks you really need to assess what you actually need open and what services you need to run.

Hope this helps

Togg