HA!  OK, this is funny :).

I got Wireshark working.  Cool.  I start looking at traffic going by.  I see
various IP addresses being talked to.  OK...cool...go find out what the IP
addresses lead to.  One of 'em leads to...FACEBOOK?  WTF?  I don't use it, I
don't *think* anything in my VM uses it...and then I realize what's going
on!  Heh.  Call my landlady.  "Hey, were you just using Facebook?"  "YES,
HOW DID YOU KNOW THAT!?"

:)

So that's where the "extra" traffic is coming from all this time.  My
friggin' landlady :).

That's OK.  I'll just do my malware testing late at night when she's asleep
:).

Jim