Sounds to me like he called cmd.exe, ran tracert into a file, then read the file. additionally, you can easily enough do a whois lookup on any ip to find all sorts of details. usually it's the ISP (ie. owner) and their address etc.
<Ingo> I can't uninstall it, there seems to be some kind of "Uninstall Shield"