My moneys on Coolwebsearch. This is a sneaky program that pulls this stunt, both to hit you with pop-ups and avoiding detection.
If you don't mind BIA - Post your hijackthis results here.
Yeager - I like MS' Anti-Spyware, however they recently bought Claria (Formally 'Gator"), which raised eyebrows at first. Yey they have now downgraded
Claria's threat to ignore
. Forget shooting themselves in the foot, as far as security experts are concerned Microsoft just shot themselves in the head. There's no defending this action!
Here's a thread on MS' downgrade: http://www.dslreports.com/forum/remark,13793423