These are getting increasingly common - the fake AV stuff is very plausable and professional looking now, and gets past several modern AV systems (Seen it walk right past Eset and AVG at least), and it gets rooted in very deep. Joinerjohn's advice is good, by the way.
Losing file associations...