Computer makes TCPIP connections on its own

My laptop would be sitting idle after 10 minutes of no use and suddenly the fan kicks up to top speed and I have a very slow time opening it up to see what is happening. I suspected some kind of hack, but never could catch it. So I got a hardware firewall and put it in the game.

I found I could boot up the Ltop just after clearing the firewall log and after getting its DHCP address and DNS ... it makes three to five connections that a WHOIS search ends by terminating in other ISP address groups. Arizona, Colorado, Virginia and Texas for the last one.

I got "Current Ports" software and only one IP addr popped up there ... but its only ID was "Process 0" and no "Name" ... which was of no value.

This one has me stumped. Antivirus/Malware software misses it entirely. On top of that, every boot seems to generate random connections in those groups. It is not the same address everytime. Someone has gone to a lot of trouble to make this stealthy and hard to remove.

It almost seems like it would have to not be using the OS calls to setup the connections...and calling the routines directly like the OS would do.

This is really weirding me out.

Any suggestions?

Thanks!

B