One of the many basic ways is by opening up the task manager and look at the "Network" Column and see what application is receiving/sending/using any internet data, if there is someting unusual in there its the source, (E.g if you see MsPaint using 10% of the Network, you should know that its a fake file and is a rat)