TL;DR it could be the router that has been infected.
My reasoning is as follows. The OP said,
- I thought I'd check the site, first via browser, no go. It still shows the site is parked, at register.com.
- Thought I'd ping the site with a command line interpreter (in this case I'm using Linux) and see what happens. Way odd. The site pings to an IP address I've never heard of before. It pings to 18.104.22.168
- I plugged that IP address directly into the browser, and immediately got routed to on of those Beware you have a virus, call XXX to get out of jail sites.
If this was a DNS hijack he should have gotten the same IP address in the browser and in the CLI. And we know that the IP works as a Web host, so it should have worked like #3 both in case #1 and in case #2.
My hypothesis is that the browser and the Linux command line are on two different machines, with different DNSs.
Since one of the two DNSs appears to return a result which seems correct (also, nothing was said about browsers malfunctions, which should be noticed way quicker than PING malfunctions), I'm inclined to believe that the browser had it right and, therefore, one DNS was correctly configured.
Where did the second DNS answer (the malwared one) come from? I'd be wary of the router. There are several worms that try and break into unsecured routers and replace the DNS server with a rogue one that supplies infected addresses to its clients.
What I see happening, though, in several small installations, is that quite often the "owner" of a workstation will twiddle with the IP settings, for example moving from DHCP to static IP address and placing "faster" DNS entries (nine cases out of ten, Google's 22.214.171.124) in the resolver setting. Absent a proactive IT administrator and strict policies in place (most small firms haven't one), the network quickly stabilizes on a hodgepodge of slowly varying IP addresses (not DHCP, not exactly static; more of a "static-until-conflict-kills-surfing" - pity the acronym for that is already taken). Some machines, usually the stabler ones, use the router's DHCP, the others slowly gravitate towards the ISP's, or Google's.
And so it happens: the Windows machine with the browser resolves the dead IP and does nothing. The Linux machine trusts the router's DNS resolver and gets handed a malware address.
Sometimes, the problem is "solved" by changing the DNS address on the machine, and no one notices that the router is still infected, but worse than that, it is still vulnerable. Today it was DNS redirection -- tomorrow a more intrusive worm can establish a tunnel and scan the intranet machines, siphoning disk shares in search of valuable information, and if nothing else, hogging the whole bandwidth while doing so.