Can I check what probably happened?
1)
Fake .mp3 file downloaded.
Length = 1 second, Bit rate = 291 - both unusual.
2)
Tried to play fake .mp3.
WMP or similar was fooled into thinking it had to download a codec to play the file.
Codec downloaded automatically as per WMP settings.
"Codec" was actually a Trojan (is that the right term?).
3)
Fake codec (?trojan) installed.
Fake codec (?trojan) downloaded malware repeatedly despite repeated deletions.
Malware caused fake antivirus popup advertising Perfect Defender.
Could you flesh it out a bit if you have a moment?
How come the fake .mp3 wasn't detected by Avast on download?
How come the link to the site to download the fake codec wasn't spotted by Spybot and redirected using the Hosts file?
How come the fake codec wasn't spotted by Avast on download?
How come the fake .mp3 and the fake codec weren't spotted by Avast or Spybot or Asquared on scanning?
What would the correct term for and the name of the fake .mp3 be? (trojan?)
What would the correct term for and the name of the fake codec be? (trojan?)
What would the correct term for and the name of the pop-up be? (malware?)
Is there anything else I can do to prevent recurrence?
I am going to put Online Armour on his computer (It's already on mine - slows things down a bit but probably worth it).
Will unchecking "download codecs automatically" in WMP be helpful?
And stop the boy downloading stuff.
Grateful thanks again.