Background: About a week ago I stumbled across some site that launched acrobat reader when it shouldn't have, obviously doing something bad. Killed it from process explorer, but damage done already. Did a scan with Trend Micro Housecall, which didn't find anything other than the usual false positives. Something was clearly still wrong, as whenever I tried to follow google results the usual way (i.e. clicking the link) I'd end up somewhere bad and cpu usage would spike. Copy link location + paste still worked fine though. After a few days, the symptoms went away on their own. Still didn't seem likely that whatever caused them had done the same. Eventually I found the Kaspersky online scanner, which found a few things but, from what I can tell, didn't do anything about them. Log saved if needed. Found the 8-step, got Avira and did the steps more or less in order (did 2 and 3 before the full scan in 1). Avira cleaned some files up in the post install quick scan (logs available if needed), then found those false positives in the full scan (I let it remove them this time, nothing I'm using anyway). MBAM and GMER found nothing, as far as I can tell. Had a bit of an issue when I reconnected the network after running GMER, with the svchost hosting dhcpclient/firewall/etc and avguard each taking 40+ % cpu; ended up pushing the reset button, and after the restart things worked again. DDS marked a line with [?], but I'm not sure that one's an issue. Not sure I know what to look for in these files either though. What I'm wondering now is, is there more to do? The requested logs are attached. DDS log is ever so slightly altered: I replaced the dns ips with a marker. They were what they should be, though I don't know if that's where they should be, so I left the line in.