PuPut, that type of "Scareware" has been around for several years, it comes and goes in cycles, as soon as the security vendors get a handle on the payload deliver they are using and add protection for it they find a new way around it. The best protection is as with most things keep your security software up to date and be vigilant with your backups (and make sure your backup plan includes the registry and System State even if you have System Resore turned on).
The Bad news is you may have picked it up days or even weeks ago, one of the newest tricks they are using is a dorman period and or a wait time before the malware payload is released. I had a system infected in March that had been offline for almost 3 weeks and the user triggered the payload part way though the first day back to work after their vacation. In that case the system was off line but powered up while the user was away, when they reutrned the system received a security patch the first thing after they logged in, a complete system scan found nothing (normal procedure for Trend Micro - after any update it runs a full system scan).
The user had still not connected to our Intranet let alone the Internet, however they ran a report and saved it in HTML format, when they double clicked on the html file to open it ie was the program that opened the report, and poof the scareware Infection message, Luckly they were smart enough to pull the plug and call me before they did anything. After some serious investigating I foumd the file that had carried the payload, it had been dormant for almost a month. I was able to clean it with some serious effort and as far as I can tell it was using a cookie counter to trigger the payload, simply stated it went wild when the number of stored cookies reached a specifec amount the payload was released and the next time ie was started the message appears.
I am not trying to scare you or anyone, I just want to point out even if it appears you were infected by a specific site, or had only visited a few in a specific period of time, it is not absolute proof, of the cause you might have picked up the bug weeks ago and something you did or some external signal set it loose.
The only good thing about these D2M malware attacks is it keeps a lot of people in secure steady employment, mind you I would gladly accespt some insecurity to get rid of the crap completely but that is not happening any time soon...
