They wouldn't need to do any redirecting if they had direct access to the computer, they could just directly install the patch/fix.

Sounds like they hijacked a malware proxy server and had it forward the traffic to their own server.