Hmmm...rushed the explanation a little bit...

What I was getting at that is part of the functionality of subseven is that it can scan for other infected/trojaned machines and then report back the results (which is what I was aluding to when I mentioned it could do scans). What I didn't elaborate on is that the connections were going out to 27374 from his computer and were probably the result of his computer being used to do further scanning...And as soulman has correctly stated, the two addresses that you are seeing pop up frequently are probably the culprits on who is controlling your computer....

More reading on subseven...(and there are tons of links in those articles)
http://www.f-secure.com/v-descs/subseven.shtml
[url]http://www.iss.net/security_center/static/6550.php[url]

Sorry, should have elaborated a little more...

Thanks for the correction.

Neb