You got to be careful visiting web sites these days. there can be all kinds of nasty’s embedded in java script, or just the page itself.
I find Norton does a good job of finding and removing those kinds of Trojans, which, because they seem to attach themselves to dll files that are ‘in use’ which makes them difficult to remove sometimes, even in safe mode, because the file is still “in use”. Norton will disable in then remove it when you reboot.
Thanks for comments of Trojan removal. I tried everything I had ever used on this one. Finally discovered it was being re-downloaded from the web each time I rebooted.
The removal tool I suggested is a command line type of app (SmitFraudFix), but it was very effective in removing this problem.
I am not sure if this was attached to the Winsock, Hijackthis showed nothing.