I created a folder HiJackthis in Program Files and downloaded it to there but each time it is a temporary file? I disabled the Windows firewall as per the instructions in the link (I am not sure how to re-enable it!)
I previousley disabled cftmon.exe as you suggested but it made no difference. I believe cftmon.exe can be used as a back door thing for trojan hijack. After the first couple of clicks on search results the re-direction stops but I am afraid that this could be some keystroke monitoring thing which obviousley is dangerous.
Below are some of the sites I am sent too.

http://www.camouflageclothingonline....t=2&rpt=1&kt=1
http://www.velvetic.com/cfc.cfm?pt=2&rpt=1&kt=1
http://aicse.com/cfc.cfm?pt=2&rpt=1&kt=1
These come with a yellow bar saying a pop up has been blocked