it's not ghash, I was having the same problem on eligius. After upgrading cgminer to 4.3.2a the hijacking has stopped, so far.
Hmm, I am inclined to agree as after I too updated to 4.3.2a all my S1s are hashing properly without "hijacking". I'm curious why you call it hijacking, is this a known security hole in the cgminer version that comes with the latest official bitmain firmware? What I'm asking I guess if it's true hijacking in the computer security sense or if you're using that as a description of the symptom - for lack of a better word.
--edit-- nevermind my question about hijacking..I read the rest of the thread and now realize it's a redirect bug.