Virus Removal Help Please!

[perodimi]

I have what I think is a malware virus with the constant pop ups recommending removal if you but their product. It claims to be from a Windows Security Center and hijacks my browser as well to "about:blank", prompting to use their free removal tool.

Avast has detected TROJAN HORSE WIN32:Tibs-AN[Trj] on one scan and WIN32:ROOTKIT-C[Trj] on another.

I cannot disable system restore as it has hijacked that as well. I tried in safe mode anyways but no luck. Ad-Aware anti spy keeps finding spyware files but the actual virus keeps re-appearing.

Please Help!

I'm running an IBM Thinkpad with Windows XP

[FreewheelinFrank]

It claims to be from a Windows Security Center and hijacks my browser as well to "about:blank", prompting to use their free removal tool.

This sounds like a Smitfraud variant.

Try running the SmitfraudFix tool as described here:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

Follow this with a scan with Ewido anti-Trojan program and Spybot Search & Destroy in safe mode:

http://www.ewido.net/en/

http://www.safer-networking.org/

To check for rootkits, try F-Secure's Blacklight:

http://www.f-secure.com/blacklight/

If you find anything, remove it, then scan again with avast!

[perodimi]

Thanks for the quick reply!

I'll give it whirl and let you know.

[perodimi]

Well it took all day and I followed your instructions exactly and success!!!

Thank you very very very much for your prompt reply and excellent advise!

Cheers