IBM x31 Thinkpad, XPpro SP1 with all updates.
Remote assistance, and Remote Desktop are both off. Simple file sharing
is off.
I have scanned with updated Sophos anti-virus software.

After rebooting, I see 3 icmp echo requests to 210.17.17.194.
Inspecting the packets I see each is slighly different.

Anyone have a cue?

The requests come from a svchost process with an open listening port
for remote file sharing at tcp 1025. Looking in the registry for the
matching svchost I find an ImagePath of:

%SystemRoot%\system32\svchost.exe -k netsvcs

searching for "netsvcs.*" fails to find a file.

The Registy lists the following as using netsvcs
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
TermService
wuauserv
BITS
ShellHWDetection
helpsvc
uploadmgr
WmdmPmSN