you do not need to know what it is or where it is, you just need to know how it is started. typically, you need to check processes in task manager, entries in registry (HK_LOCAL_MACHINE/CURRENT_USER\ Software\Microsoft\Windows\CurrentVersion\Run\) and scheduled tasks (Control Panel->Schedule)