I had a look at your comment about talking to IP "
64.120..... and 65.55...... "
65.55. belong to Microsoft hence I doubt its an issue. Maybe one of your plugins phones home.
64.120. is rather interesting as it is a known C&C IP.
imo best to run Process Explorer and see what DLL or maybe EXE loaded a long with Explorer.exe.
as the files you have sent in so far are known clean files.
Alternatively you can open a support ticket at
https://mysupport.symantec.com and attach a Loadpoint log there.