Every few minutes the computer starts the default browser (in this case Firefox 3.6) with a spam address (e.g., medicalhints dot com) which leads to a landing page filthy with advertisements.
How do I find out which process issued the command to fire up the default browser (to this address in particular, or any address in general)?
It's probably a trojan or adware.
I tried investigating which process is responsible, but I only got svchost, which is the Windows generic service runner. I used process-explorer (from Sysinternals) - which showed that Firefox was started by svchost, which doesn't help much.