Soda:

I did try using a couple of different tools.

Filemon and Regmon along with some other normal tools.

netstat -an, tcpview, fport, norton firewall logs, etc.

It was hard to trace it down, but I finally got it removed.

Thanks again!