This all started with a couple of alerts about SSL certificates.

One thing for sure is malware installed on you computer isn't going to generate alerts as that would, well, alert you to its presence. Malware is going to do its best to be completely invisible.

The alerts must have come from an application on your computer which has been directed to connect to these sites. Almost certainly this is a browser, but it could be anything that accesses the internet -- email, news reader, etc.

The most useful program from sysinternals.com is tcpview.

When they appear fire up tcpview and take a look and see what is connecting to the sites, of course the connection might have disappeared by then.If they have try exiting your web browser -- Firefox -- do the alerts go with it. Open Task Manager and check that all the firefox processes are gone, kill any that remain, does the alert disappear?

If it is the browser, what site did you visit at the point the alerts appeared, add it to your list of sites never to visit.

A web page you load into your browser is perfectly entitled to load anything from anywhere on the internet. so it can have links to these sites.