There seems to be a new malware player that hasn't been very well documented yet. This Trojan replaces hyperlinks in Internet Explorer so that when you click on a link you are redirected to a site of their choosing (or an error page). I think the links contain a code that gives the creator of the Trojan a pay-per-click reward. At least this one has a motive.

By the time I got the PC with this Trojan, it had been infected with hundreds of spyware items and the AVG antivirus was compromised. After a couple of passes with SuperAntiSpyware, SpyBot and AdAware the PC was behaving normally except for the redirected links. I manually removed or renamed dozens of suspicious files in the System32 directory, removed all suspicious files with HijackThis, checked the Hosts file and monitored activity with Process Explorer and still couldn't get rid of the Trojan. I also installed Bit Defender after reading some articles stating that they had discovered such a Trojan a few months ago. It turns out that their discovery was just a Host file attack and their product also failed to get rid of the real culprit.

I usually credit a Forum or Blog with helping me find the solution but this time it was just a matter of seeing the same name come up several times across many sites; Malwarebytes' Anti-Malware. I'm reluctant to try new 'free' software because it has cost me lots of time sifting thru the buggy and bogus products that are available but this Trojan had me stumped. I ran the Malwarebytes product and it found and removed the offending files and registry entries. It turns out that I missed them when looking for 'dll's' to delete in the System32 folder. In order to help others find this article and compare their problem with the one I had, I'll post part of the Malwarebytes' log. This is now going to be one of my standard tools as it really worked in this tough situation.

Registry Keys Infected:
HKEY_CLASSES_ROOT\oberontb.band (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\oberontb.band.1 (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\altcmd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Alex\Application Data\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\altcmd\altcmd.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd\uninstall.bat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Alex\Application Data\wsnpoem\audio.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Alex\Application Data\wsnpoem\video.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Alex\Application Data\wsnpoem\video.dll.cla (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Mari\Application Data\temp.dll (Trojan.Agent) -> Quarantined and deleted successfully.