Thought I would share with you in case it is helpful:
I struggled for months to get rid of a browser redirect virus. It's characteristic was that it hijacked google-analytics to 220.127.116.11 and so it would hijack my clicks to unintended
sites. I have no idea how I got it.
I finally found my problem:
First, it was manifested by doing a PING to google-analytics. That got hijacked to 18.104.22.168 wich is some rogue address (I wish someone could do something about them).
Second, the problem was detected by kapersky 'TDSSKILLER' utility. It detected a problem with SPTD.SYS. I removed that file but then my system was not happy on rebooting.
I found that file was part of deamon lite, so I reinstalled that freeware, and I am finally back to normal!!
PS some folks that have this problem find it to be in their router, and thus will never find it on the computer, so be sure to check that out. May need a reset of the router.