fake antivirus...and then new registration

General Topics
1

I clicked on the result of a google search and got a message saying I had been infected by countless viruses and to click to remove them…and windows security had been corrupted (or similar) I’m not quite so stupid (but do realise why people do!)
I clicked in the corner to close and got other messages and then (I think) Firefox asked me if I wanted to download a .exe file. So I said closed the top corner and closed down firefox.

(Because I’m stupid!) I went back to the link to see if it was connected and it was…I then tried to notify the website - but couldn’t get anywhere- either got the same fake warning or the server was busy for other names at the same site.
I googled ‘handprint clipart’ - near the bottom was ‘baby handprint’ and the web site was something like whitneycettell.pnliginqo.cc - it has disappeared from the google search now.

I tried to do a scan and Avast told me I needed a new licence key - but I got an e-mail saying that I couldn’t get one …and then I found an older (less than a month old) e-mail with it in and that worked
I then did a complete system scan using Avast - to try and make sure I hadn’t picked up a nasty -it came back clear.

This morning when I booted up I got a red box in the RH corner saying Avast had expired and I need to re-register…I didn’t click on it but went to the avast site and re registered and got a new licence key.

After a quick look on here, I went to repair in Avast - but it said I needed to do a full update so I did (it also said the last time I used it was a week ago …but I should have used it yesterday…). It all seemed to work, I rebooted and the warning box disappeared…

Can any one make sense of this - is the Avast thing just a coincidence? I have had Avast for a couple of years - but about a month ago I had blue screen problems and had to have the Windows completely reinstalled -they put Avira on but after a few weeks I found I preferred Avast so downloaded it again and uninstalled Avira…so I don’t know if the fact that I originally had it on my system counted towards my registration period or not…otherwise I would be really concerned…

Should I run anything else to make sure everything is ok?

2

I suggest:

  1. Clean your temporary files.
  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  3. Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
  4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
  6. Clean your Hosts file (replacing it) with HostsMan tool.
  7. Disable System Restore and then reenable it again.
  8. Immunize your system with SpywareBlaster.
  9. Check if you have insecure applications with Secunia Software Inspector.