I'm no PC expert, but I had this happen on my Windows Vista Home Premium system At that time I could no longer execute any programs or even use CTL-ALT DEL to access Task Manager. I had to reboot in Safe Mode to be able to do anything, but I was able to find a folder that looked suspicious. It was created on the date and at the time the phony anti-virus messages started occurring. In Safe Mode I opened Windows Explorer and navigated to Computer>Users>myusername>AppData>Local and right-clicked the top bar to add a column for "Date Created". There I saw a folder called "ghxbnerde" with the date and time matching the start of the attack. After backing up the folder on a flashdrive (just in case), I deleted it from AppData>Local and rebooted normally. No more issues!