Spy on Network

I have a network of about 150 machines. All but about 10 are win2k and the others are win98se. I feel confident that the win2k machines are locked up well. But I have a bad hunch about th 98 machines. The CEO came to me the other day and explained that something fishy is going on and that confidential information has been exposed beforehand. He and I both looked at each other and have an idea of who it is. I am almost 90% sure this person planted a keystroke logger or frame capture program on one of the 98 machines. I am somewhat familiar with a few of these programs, but is there some sort of “sniffer” that can pick these things up? I looked in the msconfig startup and saw nothing funny. Any ideas??