The service was called of all thing 'Network Security Service'. The file was ipcw.exe, sitting in the Windows directory. Service name was a bunch of gibberish.

But then there were a bunch of other small exe files sitting in the windows directory that would fire off as you removed them, so ina s ense one would take anothers place. They were dated back to about March 9th, so it was probably going on since then.