I can think of at least nine ways to achieve this effect, off the top of my head:
- A malicious plug-in.
- A malicious proxy auto-configuration script.
- A change to the proxy settings that directs all requests to a proxy HTTP server that is under the control of the advertiser.
- A whole list of new entries in your
hosts file pointing to a content HTTP server that is under the control of the advertiser.
- An ISP that requires authentication before letting IP traffic go anywhere other than a network controlled by the ISP.
- A change to the DNS client library settings that directs all requests to a proxy DNS server that is under the control of the advertiser.
- A problem on some other machine that your machine relies upon for proxy DNS service, proxy HTTP service, or IP connectivity.
- A malicious DHCP server on your LAN handing out leases that have bogus DNS proxy or HTTP proxy settings.
- A malicious host on your LAN that has been registered as
wpad, and that is handing out bogus PAC scripts.
There's not enough information in your question to eliminate any of these. I'm discounting the possibility that you're living in a country whose government decides what companies on Internet its citizens can talk to, on the grounds that you wouldn't need to ask about that. Malice for profit is more likely than malice for ideology, in this case.
First, remove the malware/machine that did this. SuperUser has a general question on this subject, which I'm not going to repeat here. Then clean up the problems that it left behind. You'll have to go through all of the configuration settings for plug-ins, PAC scripts, HTTP proxies, and DNS proxies and check that they are appropriately set. See this question for cleaning up DNS hijacking.