Leave Process Explorer running on machine and whatever is triggering it should appear in it
Process Explorer.
In it ,hit options and select "verify image signatures"
Then hit view,select columns and check "verified signer"
Hit options again and select "difference highlight duration" and set it to nine seconds
Get a screen shot of process and attach images in a folder attachment
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspxDid you change to get a Url from a link within message,if any?
Also port 135-anything in Active Ports?