New attack vector? Outlook 365 Renew button

My Outlook 365 renew button kept popping up as I was close to the end of my one year term with Office 365. The first time I clicked on it live.com opened as expected. In addition, 54e.com opened in a 2nd tab of my default browser. I closed that after disabling all addins and extensions except Avast.

I opened Outlook again and then clicked on the renew button. Live.com also opened and 56e.com in the 2nd tab.

I am not an antivirus expert, but am quite technical and very meticulous about security on my laptops. Just wanted to share as I could find nothing about this on the internet.

Even more disturbing, when I put a live.com link in Word and clicked on it, there was no 2nd window in my browser. So, it seems linked to the renew option.

if you want a malware expert her to check, follow instructions http://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes / OTL / aswMBR logs