A firewall will only show activity for a module or app trying to connect. Not all
malwares phone home. I would try to get to the bottom of it, once and for all.
I should have thought refer you to a security forum earlier. I suggest you register
and post on this TH forum. They may have seen this come up before.
Mischel Internet Security Forum
http://www.misec.net/forum/?board=TrojanHunterBlocking Unwanted Parasites with a Hosts File