Friend has some sorta spyware...Can I get some assistance removing it?

First off, he got it off facebook somehow. =/It's called something like "Protection Tool", and it blocks literally, EVERYTHING from executing...I've tried the portable, randomly named edition of SuperAntiSpyware to. I'm getting ready to try thebootable version of SpyBot S&DIt is bootable, so I believe it will work...Is there anything I can do if it doesn't other than formatting it?

try running malwarebytes antimalware in safe mode

Windows Defender supposedly works on it as well, but do it in safe mode as was recommended.

Loonylion · #2try running malwarebytes antimalware in safe mode

He doesn't have it installed, so if it requires installing, it's a no-go. =/

Replying to #3

He's running XP, which I rarely use, even in a VM, so I looked in control panel, didn't find it...Does XP have it?

If any of that other stuff doesn't work, then here's something to try as a last resort:

To remove Online Protection Tool, you must first stop any Online Protection Tool processes that are running in your computer'ds memory. To stop all Online Protection Tool processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Online Protection Tool, then right-click it and select "End Process" key.To delete Online Protection Tool registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Online Protection Tool." Right-click this registry key and select "Delete."Finally, to completely get rid of Online Protection Tool, you must manually remove other Online Protection Tool files. These Online Protection Tool files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Online Protection Tool might create a file like
%PROGRAM_FILES%\Online Protection Tool\Online Protection Tool.exe. Locate and remove these files.

From what I've read, this thing also screws with router settings so you might want to check and see if that was redirected as well. Your friend seems to have caught a fun one.

Replying to #5

Just walked all the way back down there and tried it using CTRL+ALT+DEL...I already tried opening task manager by right-clicking the taskbar, and that didn't work...So I tried this, and it didn't work either..
Should I tell him to boot it into safe mode to attempt that?Also, it did redirect his router, it takes him to a page where it tries to get him to purchase it. -.- Quite fun if you ask me...

Is this ithttp://www.bleepingcomputer.com/virus-removal/protectingtoolLOLAnd read up on something called "RKill",as that will stand you in good stead for the futureLOL

Replying to #7

The screen shot is awfully similar, but just not it...

Tomoka · #6Just walked all the way back down there and tried it using CTRL+ALT+DEL...I already tried opening task manager by right-clicking the taskbar, and that didn't work...So I tried this, and it didn't work either..
Should I tell him to boot it into safe mode to attempt that?Also, it did redirect his router, it takes him to a page where it tries to get him to purchase it. -.- Quite fun if you ask me...

It probably disabled it in the registry if you can't open it.http://www.megaupload.com/?d=4820P31Y^Try this version of malwarebytes. This one requires no installation so that shouldn't be an issue.Do this stuff in safe mode as well if you're not already.

This is an example of rogue shithttp://www.bleepingcomputer.com/virus-removal/remove-avg-antivirus-2011Notice that things may have to get renamed if the rogue shit blocks them from running eg MBAM and RKill.

Reider · #9It probably disabled it in the registry if you can't open it.http://www.megaupload.com/?d=4820P31Y^Try this version of malwarebytes. This one requires no installation so that shouldn't be an issue.Do this stuff in safe mode as well if you're not already.

Will have him try that tomorrow, to late tonight. >.>

Replying to #10

The portable edition of SuperAntiSpyware was randomly named upon clicking the download link, yet it wouldn't let it start. =/

thats why we're saying use safe mode, its likely theres a process running that blocks executables, starting in safe mode prevents software that starts on boot from running automatically.

Replying to #12

I only stepped in because depending which malware is involved,a different approach could be needed.http://www.bleepingcomputer.com/forums/topic308364.html *see post no.3*And Ryan,why are you mentioning "SAS"-I dont see anyone advising you to use that.Am I wasting my time trying to help you,have you
bothered viewing the links(by one of the top security sites) so that you know what to do if you cant access safe mode,or cannot run MBAM

Replying to #13

You are not wasting your time, I have thoroughly read each link you've posted. :P

Well1.It should now be fixed then
2.You now know as much as me in that respectLOL

Replying to #15

It would be if I had been over there since I posted this topic, but alas, he's not home today. >.>