Detecting which service/process starts a web-link on Windows XP

Question

Every few minutes the computer starts the default browser (in this case Firefox 3.6) with a spam address (e.g., medicalhints dot com) which leads to a landing page filthy with advertisements.

How do I find out which process issued the command to fire up the default browser (to this address in particular, or any address in general)?

It's probably a trojan or adware.

I tried investigating which process is responsible, but I only got svchost, which is the Windows generic service runner. I used process-explorer (from Sysinternals) - which showed that Firefox was started by svchost, which doesn't help much.

Answer 1

Process Explorer will show you which services are running in that particular instance of svchost, in the Services tab. Look for anything unusual.

(I have a guess that it could be Task Scheduler. Third-party services rarely run inside svchost.)