Ah, probably the scareware strategy. What happens is that while you are browsing, you suddenly get a popup claiming that your computer is infected with so and so many viruses. If you click anywhere on the popup (including on the "x" to close it), you can get redirected to the malware site, where the fake antivirus program will either try to install itself on your computer at once, run a fake scan and tell you to pay for virus removal, or coax you into buying the fake antivirus software...The goal is to get at your money. So do not ever click on such a popup. Instead, either close your browser by using the keyboard shortcut Alt+F4, or, even better, break your internet connection by turning off the Wireless switch or unplugging the internet cable and then closing your browser.
About leftover Norton entries in the registry: Norton Removal Tool:
https://www-secure.symantec.com/nort...rProfile_en_us
If you use it, it is best to run it twice, rebooting after each run (should happen automatically). You may also want to disconnect from the internet. And finally: the tool removes ALL Norton products on your computer. If there is anything remaining, then it will not interfere with your computer. The removal tool intentionally leaves behind your Norton product key in case you want to install your Norton product again at some later point in time.
And finally, what REALLY happens once your Norton subscription runs out is the following: Norton will turn itself off completely. That is all. Until you renew your subscription. This is something which, to my knowledge, is done by most major antivirus software vendors.