Ahh if you have netstated numerous times, try catching which IP he's working from. Resolve some IP's to host's, figure out which one's are website's/applications and then narrow down from there. Do some lookup's too as in pinging, do some monitering of which ports seem to be most active and how much activity, close them, etc. If you need more extensive help, PM me and I'll do my best.