C:\WINDOWS\I386\HOSTS
C:\WINDOWS\DRIVERS\ETC\HOSTS
Some of these parasites are clever and will contact the server from which they originated if they are removed (a separate, companion startup program sometimes checks for them and does this).
I got just such a parasite a few weeks ago when a DSL outage forced me to connect directly to the Internet without a router. Sure enough, the DSL came back up while I was at work and someone stuck spyware on my machine. The Ethernet light on the modem was going crazy when I got home - while the computer was sitting there (ostensibly) idle. A number of legitimate-looking programs, with names like "Class", were part of the cluster of executables comprising this particular annoyance. All had to be removed - deleted from the Registry and physically renamed and then deleted on the hard drive, with several intervening reboots. It can be done, however.
In most modern networks, your HOSTS files should be empty. Forgive me if any of this seems overly pedantic as I've no idea of your level of technical experties.
Unfortunately, I'm not expert enough to do all that myself. I just run 3 spyware removers & hope that does the trick. Sometimes it works, sometimes not. I had to pay a repairman $60 to fix it once. The spyware was so thick I couldn't even get my spyware removers to update themselves. I think these spyware programs must have ways to sabotage the removers.
They need to do something to shut these guys down, or at least make it more difficult for them.