I think the problem coud be cured if you changed your ISP info meaning: scrap ISP
and get a new account because your ISP log on info is stored by these hackers,
and every time you log on with the same ISP info you get rolled.
From what I read it takes about 5 min after a clean OS install
during this time your logon info is probably being compared somehow it appears that all the jacked and stored DNS servers info is being polled and compared and send back to a known active connection.
the only way to get rid of the problem is to find the source.
Now how is that for some trouble shooting?
This might be a solution someone would have to try it out first,
but that's pretty shitty if you have to create a new account.