Hi,

Cyber1d is correct in that this stuff is stealthy, it is also technically "legitimate" depending on how it is used, so countermeasures providers have to be a bit careful?

Try: http://digilander.libero.it/zancart/winsonar/

That might help you catch anything that kicks off in the background.

Good luck