The most likely cause is that a proxy server is configured (probably to 127.0.0.1/localhost) because some SpyWare will actually act as a proxy server so that it can replace/insert advertisements in HTML documents on-the-fly as they are downloaded in real-time.
SpyWare and virus removal tools don't usually change the proxy server settings because there are often legitimate reasons for them being there (e.g., in a corporate environment where proxies are required for internet access, intentional anonymization, etc.).
To change your proxy server settings:
- Control Panel
- Internet Options icon
- Connections tab
- LAN Settings button
- Proxy settings section (this is where proxy servers are usually specified)
If that's not it, then you probably need to get the WinSock Reset tool from Microsoft. There's a document somewhere on Microsoft's support web site, but this document is a bit of a moving target so you'll need to search for the keywords "winsock" and "reset" at this web site: http://support.microsoft.com/