My wife's computer got pwned somehow this evening, so instead of catching up on posts I played whack-a-mole with Antivirus Live. It appears to be gone, but I'm watching things closely.
I just can't figure out how it got installed. From the timestamps, it appears to have downloaded the necessary bad files while we were eating dinner, but I don't know how long the installer was on her computer or what turned it on. The files were all in one of the random free trial copies of CakeMania 3 I warned her about downloading, but she downloaded and played that months ago and hasn't touched it since. If this were a different kind of malware I could see it hiding, but the Antivirus Live people make their money by being highly visible. It just doesn't make sense that it would intentionally hide for six months.
I'm also doing a MalwareBytes scan of my computer, to be on the safe side. Full scan. I have well over a dozen RTW/BI mods installed. This might take awhile.