I'm going to second the suggestion to run a full, updated virus scan. There's a recent, pretty nasty exploit going around, and if you've got windows file sharing ports exposed to the internet (ie: TCP 137-139, UDP 135) and didn't install the updates tuesday or wednesday of last week, that could be it right there.
Other than that, check the system event logs (control panel -> administrative tools -> event viewer) for anything that looks interesting and corresponds to that.