First of all I would like to thank Hesreus for his good views on detecting the criminal guy.

Just to add to that there is a good freely available tool called NetTools 3 (search on google).
It can list down all the processes running on you pc along with the program which has opened that process.

So that can be used to see which program is trying to connect to some unknown IP address. Record that ip address and do a whois query to find out the isp.

Or use the tool www.ip2location and find out the city from which the ip is orginating.