Over the last few days, I've received the message "Waiting for 126.96.36.199" in the bottom left of my screen when I've tried to do a Google Search. Thereafter, I've received normal-looking searches that link to nowhere or to unrelated sites.
Malwarebytes and Spybot S&D missed it. The trojan may have already been removed but the file remained: a second file labeled wdmaud tucked away in my system32 folder (the sysaudio, NOT the driver). I read this means my searches were being run past the NSA. I read somewhere else they were being run through someone's house, in Bulgaria. Either way, someone has been very very bored -- and very very bad.