Fixed an "Antivirus 2010" scareware infection that spontaneously installed when simply VISITING a website on a fully patched but EXTREMELY slow netbook (one of the early ones that was never supposed to have Windows loaded on it's 8GB "SSD"). Even with every tweak in the book, Firefox, Opera, and Chrome are unusable, so I had to stick to FAT32 with FalshPoint/FlashFire filesystem drivers and Internet Explorer to make Internet browsing even remotely feasible and even then it locks up for minutes at a time with the SSD access light just solid and the entire system unresponsive between nearly every launch or page change.
I'm not sure which triggered it, but I had browsed from Engadget to MaxConsole to ModMyI when the Java logo showed up in my taskbar tray area next to a fake Security Center logo. It was entirely a drive-by exploit of IE/Java as nothing was downloaded and executed deliberately by me or my actions. After that it was tons of fake virus scan windows and messages popping up.
It was relatively unsofisticated even though it was launching in Safe Mode... "End Process Tree" on "av.exe" was all it took to delete the av.exe and "JNvc" files it created. Luckily, FAT32 would've made that easy enough to do even if it were truly rooted and the process could not be killed. Anyway, that caused the system to no longer run EXE file because it had configured itself as the handler/"virus scanner" for any executable files accessed, including CMD (launching gave you the dialog to create a file association with the "Always use..." box grayed-out). That meant that I couldn't launch REGEDIT either. A work-around for, say, launching MSCONFIG was to point it (or any EXE you attempt to launch) to MSCONFIG.EXE. That doesn't work for REGEDIT of course because REGEDIT will try to add that EXE to the registry and balk at the fact that it is unable to do so (considering the EXE isn't a formatted REG file). The work-around for launching REGEDIT was to create a "START ...REGEDIT" batch file and run that. From there I exported then deleted any reference to av.exe and compared it to another XP system's registry to restore the keys to what they should be. That actually hosed it slightly worse (corrupted icons; still unable to launch EXE files). Ultimately, after all that, I just did a restart to confirm that av.exe was not loading/reinstalling itself and then used a BAT file to launch iexplore to nab the latest MBAM. Malware-Bytes Anti-Malware didn't detect the actual files from the infection (rather than delete immediately, I copied them and left renamed version in the original directories in case an accurate detection was needed for repair) but it did detect the damage left behind as an Application File Exploit and fixed that.
I had to repair my icon cache after that and all was back to normal. I guess it's a lot easier than if they had used one of the truly nasty rootkits but I was still plenty angry about all the wasted time (my other PC is having a hardware problem and this was really all I could use).
I learned my lesson. Next time I'm forced to use IE, I'm getting rid of JRE, Flash, and browsing with no images or add-ons! Somehow, I'm still not sure that would've helped. I just wish I knew which of those sites' adstream was compromised so that I could inform them and know which were safe to return to on te same netbook.

I resorted to my iPhone when I want updates from those sites.