Spyaxe

[horace]

Dear All,

I would just like to say that I battled for 8 hours with this SpyAxe self-installing program. This supposed anti-spyware program installs itself just through surfing and is very annoying as it generates and continual popup on the taskbar, as if it were a genuine windows security alert.

I used all the programs I could find to try and get rid of it.

My McAffee didn't help

And the removal instructions for spyaxe on the mcaffee site took ages to carry out and didn't work.

Spybot came up with some entries but didn't get rid of it nor did any of the most trusted free malware removal tools.

IN THE END THE BETA MICROSOFT ANTI-SPYWARE PROGRAM DID THE JOB.

I would recommend that users run this first based on my experience.

N.B the instructions for manual removal on the McAffee site did not help

and nor did those on the Norton site

[Chappy]

I would just like to say that I battled for 8 hours with this SpyAxe self-installing program. This supposed anti-spyware program installs itself just through surfing and is very annoying as it generates and continual popup on the taskbar, as if it were a genuine windows security alert.

Heh...a drive-by install calling itself an anti-spyware app...what do these people think.

I guess there's enough n00bs out there to actually believe that something like this is OK/normal, and trust this POS program.

Do you remember where you were when you got this?

Did you recieve any notification of a d'load at all? (accept an activeX maybe?)

[Chachazz]

Moving to Spyware/Adware forum for further assistance;

[thesidekickcat]

From the sounds of what it takes to remove SpyAxe (also SpyTrooper, and I think there is one other in the clan too), it is a major current (perhaps last six weeks or so) extremely nasty piece of malware.

I learned of it while being one of the participants in what turned into a marathon thread with op having many popups including Spyaxe etc, eventually culminating with a HJT log over at G4 recently. Just about when I had the man convinced he could do a HJT log, cabdad posted with his experience recently spending several days trying to get rid of SpyAxe but unsuccessful so did a clean install, and he included many very informative links. Well I read several of them, and as luck would have it, one showed just the day I read it that an automatic removal tool was now updated to do a better job in removing SpyAxe. Further postings by cabdad there and elsewhere mentioned that it may take several redos of the tool to be totally free of it.

So I will post a link to the marathon G4 thread...cabdad's post is about 54 or so, my followup is a couple of posts down, and his followup after mine. cabdad's first post there gives many very useful links discussing this nasty bug, and the evolving methods to deal with it. Thankfully there is a removal tool now available that with repeated use seems to clean this thing out, along with Ewido (sp?), done just beforehand.

Marathon G4 thread with lots of SpyAxe info about 54 to 57 posts in...

This thread is shorter with additional info from cabdad.

SpyAxe thread at G4 with info from cabdad

Evidently we are not very well protected yet from this nasty piece of slime malware. Though when I checked through the last two updates of Spybot Search and Destroy, it listed both SpyAxe and SpyTrooper. I don't know if it listed it on earlier updates. So be sure to have Spybot installed, updated, and immunized.

Edit: Here is another link to a SpyAxe/SpyTrooper problem thread and further down mentions Winhound as part of the evil mixture.

G4 thread on SpyAxe/SpyTrooper, and Winhound too

Beware and take care folks, stay safe.

Pat.

God bless everyone

Edited December 14, 2005 by thesidekickcat

[Matt]

SpyAxe is a new raising threat in the malware community. The occurances of it is growing every day. If you do get infected with it, you can post a HJT log in the malware removal section. The HJT experts will have a tool available (probably along with other things as this is usually bundled with other malware) for an easy(er) removal.

Matt

[Dan]

Hey Guys..

SmitRem will remove it

It's not really /hard/ to remove, just a pain in the arse!

Danny