Anti-virusscanonline takes over browser session

I am having a problem with pop-ups from a rip-off antivirus called Anti-virus 2008.
It pops up in a surfing seesion,minimizes the browser window,shows a dialog advising a scan,and it is impossibe to shut this window down.
It is kind of cute as the dialog reads something like
"Do you really want to navigate away from this window?
Press cancl to scan your computer or ok to to move to the next step"
The only way I have found to stop this is to kill the Browser with task manager,and lose all of your tabs.
Firefox "SiteBlock" does not work.
The url changes allmost ever popup,and half the time it will not block even the address's on the list.
Any ideas?
Thanks
MS Windows Xp SP3,AMD Athlon 64X2Dual core processor5200+,894MB Ram.
Avira Anti-vir classic,SuperAntiSpyware,Malewarebytes antimalware free,SpyWareBlaster,Kerio 2.1.5, Sandboxie

 

Try RogueRemover.

http://www.malwarebytes.org/rogueremover.php

It may be on the list of rogue software RR removes. If it is not then pist about it in their forum and I am sure they would be interested in your issues.

 

Here is a current list of rogue products RR removes.

http://www.malwarebytes.org/roguenet.php

It does not look like anti-virus 2008 is listed. So maybe make a post in their forum.

 

Thanks,
I left that one out!
Rogue remover says no detection. I have already sent them an e-mail,as they request users to to report new rogue applications.
I dont thank my system is infected,as I have never downloade any of the dreck.
(although sometimes its tempting just to try to make it go away!!)

If something is in the system I guess it would just be foolish to expect,but would it show up in add/ remove programs or services,or process manager?
A-Squared Hi-Jack Free does not listed any hinkys either.t

 

Run a scan with SAS and with MBAM.
And post a HJT log on any forum listed here.

 

Are you the only one who uses that computer?
What browser do you use?

 

Malewarebytes anti-malware :no detection.
SuperAntispyware detected a couple of tracking cookies that made it past Ccleaner.

I am the only user.
I use firefox 3

Will the listed sites take A-squared free Hi-jackfree,,or do I need to download Hi-jack this?
thanks for the help

most of the time i can "tab around" it and keep going,and i am almost always sandboxed,but i still have to terminate the window it has tied up with task manager.

Also for what irs worth I have the same issue when i use IE7,so SpywareBlaster does not block it either.

 

Maybe you could post a few screenshots, so help is easier.

 

Also, try adding the anti-execute settings in sandboxIE (asuming you use sandboxie as the sandbox).

Have you tried CureIt?

 

I have the screenshots copied to word pad,but that will not paste here.
(i have no idea how to do it)
I do use Sandboxie,and will try the settings you spoke of.
I have downloaded "Cure-it" and will open it.
hope you can tell me how to post the screenshots,as i have the whole mess
i get.

 

Hello normishmael. If Dr. Web CureIt fails to remove antvrs.exe, try SysClean. Download the following and save them in one folder,

http://www.trendmicro.com/ftp/products/tsc/sysclean.com
http://www.trendmicro.com/ftp/products/pattern/spyware/ssapi/ssapiptn655.zip

Go to safe mode. Extract ssapiptn655.zip, run SysClean then scan.

thanatos

 

thanatos:
Thank you.
DrCure it has a very through bedside manner,and his complete scan looks good for at least an hour.
I have to strike a coil for a few hours.
I have downloaded the exexs of the programs you advised and will run the in the morning.thanks for all assistance.

 

Maybe not needed now, with thanatos's utilities, but in case you need it in the future:

-save the screenshots in .jpg.
-now, when your replying to a post and are writing, scroll down the page, until you see the button "manage attachments", under "additional options".
-click the button.
-browse for your screenshots. You can add up to 5.
-Click upload.

You will then see a list with your attached screenshots.

For posting the screenshots, just copy and paste the [ attach]here goes a number[/attach ] where you want to put the screenshot in your post.

Good luck with your problem.

 

If you would like, you can submit a support request using the link below and we can run a custom diagnostic and see what's going on and then post the results back to the group here:
http://www.superantispyware.com/support.html