Check for unauthorized shares. If you notice an odd share name the tools will show you the actual location on the system that is being shared. A drive or directory can have multiple share names. Each of these shares can have different permissions associated with them. Check for any jobs scheduled to run.
Intruders can leave back doors in files that are scheduled to run at a future time.
Check for odd processes. You can use the Task Manager tool or the pulist.exe and tlist.exe commands from the NT resource kit at the command prompt to gather information about the processes running on your system. With the pulist command, you can see who started each process. The tlist command with the -t flag will show you what processes started child processes. Look throughout the system for unusual or hidden files.