Prevention best fix..
Maybe someone can explain why running as a restricted user would let this trojan take over. My clients know better than to click on anything like this or even smelling like a fake alert. Most of them would do a force shutdown, and reboot to safemode and run CCleaner - VOILA! No more scamware!
Somebody tell me I'm wrong?!