Anti Sniffing measures.

I have a problem with 3 separate programs on a network that need to be stopped. My main concern is that they are packet sniffing. They are on computers that restore to their original state every time they power down so im thinking they we're put on partition that doesnt change. And i have reason to believe they got their by physical access to these computers. I a. Want to stop the programs asap but cant seem to find them. Im thinking of just telling the switch to block the ports that i can see it running on. b. want to catch the person who put them there.

Ideas? Thanks in advance.

Using system restore an option? Would at least give you some idea of when they first appeared.

i'll look into it. Its not my network so i wont know till tomorrow. But i think because of deepfreeze it might not have restoration software you know? cus there is only one point.

What is it like a college network? Is someone grabbing everyones passwords?