Could it have been:
I don't want to post the link - but yes, there is a webpage with hardcore-lesbian-orgy photos/xxx-adult-photos/heat.
My neighbor was heeding off to a presentation and his laptop (with presentation) was popping up porn sites and more.
The key component seemed to be NTORMS or NTORMS32.
While I killed it off, in the rush I didn't take notes.
As such, no reply is expected, but what home, search page and more hijacker did I remove?
PS. He now believes... He's using Firefox most of the time now.
PPS. The pest is gone for now. Sorry I didn't keep a good record. When you go for 120 second cures, it happens.