i would bank on software of some sort, perhaps sending itself to a local proxy. if your lucky, it will show up in add remove or netstat -a. i would try using tcp view and process monitor to help isolate.
The following get loaded in safe mode with networking:
Network Adapters (wired Ethernet and wireless 802.11x)
Dynamic Host Configuration Protocol (DHCP)
DNS
Network Connections
TCP/IP-NetBIOS Helper
Windows Firewall
you may also wish to verify there are no services running in safe mode that aren't in normal mode.
Thank and Regards :
myLoneStar