I'm about to do all this, but I figured it might be worth a mention that, while I was gone tonight, Norton ran its weekly scan and came up with woinstall.exe, under threat name Adware.Ezula. It's quarantined now, but I assume everything's relevant