In addition to windows being generated by normally authorized processes, a trojan will almost always create a hidden window for its own server purposes. The Window List tool can be used to spot any suspicious window entries and allow you to examine them. By highlighting any suspicious windows and pressing Show you will be able to examine its contents. When you're done examining the window you can hide it again by pressing Hide. You can also see and examine windows that are untitled by checking the "Show untitled windows" box. Show the window to examine exactly what it looks like.