to find out who accessed/downloaded from the internet in the past:
dunno. search for files modified between 6pm and 6am?
to see who it is while it is actually happening might be useful, too?
http://answers.microsoft.com/en-us/w...f-9841a072ec10
real firewall software could also have a feature to track statistics of network traffic and causing processes. (from the moment onwards you activate that feature)
or check your router: maybe it has a logging feature that lets you trace back to the process name which triggered the internet access.
(from the moment onwards you activate that feature)
I used to run "Netlimiter 2" on Windows. Freeware up to Vista. Unfortunately, a license for Windows7 costs 30 US$.
From my Windows days I also remember that there is a setting for Windows Software Update to run the actual download but to wait for install command. Maybe check that you have disabled the hidden download option?