Open DOS and type netstat

This shows all current connections. It may be that this trojan is logged in to several networks and has the URL catcher turned on to automatically send you to infected websites.