It doesn't necessarily mean hosts.ini was changed, and that would only change DNS results. (no pop-ups off a sub-domain) What version of windows are you using?
Also, what's the modification date to your win.ini file? Has it been modified recently? If yes, what are the recent entries?
Also, what's the modification date to your win.ini file? Has it been modified recently? If yes, what are the recent entries?











