Wireshark's gonna be a lot of work. It's going to entail leaving a PC on your customer's network to monitor packets, then sorting thru those packets, and for what? Only to find out these people are infected with spyware and viruses? It's not worth it, IMHO.

If I had to do anything in your sit, I'd just get on their machine, run msconfig and pull up their startups and simply point out that there's a big part of their problem, and that there's hidden apps running beside those in all likelihood. Then, if need be, run msconfig on your own machine and compare them.