My moneys on Coolwebsearch. This is a sneaky program that pulls this stunt, both to hit you with pop-ups and avoiding detection.
If you don't mind BIA - Post your hijackthis results here.
Yeager - I like MS' Anti-Spyware, however they recently bought Claria (Formally 'Gator"), which raised eyebrows at first. Yey they have now
downgraded Claria's threat to
ignore. Forget shooting themselves in the foot, as far as security experts are concerned Microsoft just shot themselves in the head. There's no defending this action!
Here's a thread on MS' downgrade:
http://www.dslreports.com/forum/remark,13793423