This firewall has that same feature. It did not appear that some other program was using scrnsave.scr. It looked like it was doing it directly. However, it did mention that the parent process was winlogon.exe, but I think that was because winlogon.exe was the process that started scrnsave.scr.
So far, I've done scans with Spy Sweeper, Adaware, Spybot S&D, Ewido, and Avast and I haven't found anything. I really have no idea what's going on. I also have not seen the screensaver attempt to access the Internet since the two attempts yesterday.