[Angel-Wings]

Download all files from trusted sources again, then your files. Create checksums for both (SHA256, RMD160 etc.) - not MD5 and compare what has changed and what you changed

Then make a backup of your database and import it at your test machine going through the templates to search for the URL's being called when opening your site or loading of any external URL's - both inside the PHP files and your Templates.

Some files like the original VB ones call home and some Addons / Template authors do the same when installing their content, quite easy to find these, still the 3 URL's you mention are located somewhere.