SpyAxe

My system is infected with a "program" called Spyaxe and I cannot remove it.
I keep seeing a little balloon in my taskbar that says I am infected. This
stays around, even after I remove the program and its shortcut. When I
restart the system, it re-installs itself. It also appears to bring in other
trouble, such as something called "antivirus gold". Is there some
step-by-step removal procedure "for dummies"? Somebody mentioned a
noahdfear--any comments?

Many thanks in advance, and best wishes for the New Year,


--
Harry Keijzer

Microsoft Live Safety Center
http://safety.live.com/site/en-US/default.htm

Microsoft Windows AntiSpyware
http://www.microsoft.com/downloads/d...displaylang=en

Here's what you can do to enhance the security on your PC
http://www.microsoft.com/athome/secu...2/Default.mspx

--
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/

-------------------------------------------------------------------------------------------

"Harry Keijzer" wrote:

| My system is infected with a "program" called Spyaxe and I cannot remove it.
| I keep seeing a little balloon in my taskbar that says I am infected. This
| stays around, even after I remove the program and its shortcut. When I
| restart the system, it re-installs itself. It also appears to bring in other
| trouble, such as something called "antivirus gold". Is there some
| step-by-step removal procedure "for dummies"? Somebody mentioned a
| noahdfear--any comments?
|
| Many thanks in advance, and best wishes for the New Year,
| --
| Harry Keijzer

From: "Harry Keijzer" <HarryKeijzer@discussions.microsoft.com>

| My system is infected with a "program" called Spyaxe and I cannot remove it.
| I keep seeing a little balloon in my taskbar that says I am infected. This
| stays around, even after I remove the program and its shortcut. When I
| restart the system, it re-installs itself. It also appears to bring in other
| trouble, such as something called "antivirus gold". Is there some
| step-by-step removal procedure "for dummies"? Somebody mentioned a
| noahdfear--any comments?
|
| Many thanks in advance, and best wishes for the New Year,
|



Two part reply..

Perform Part 1 then perform Part 2.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.

If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp




Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

Alternate:

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Search on here for Spy Axe, (go 'Find' Spy Axe). I had it recently and got
rid of it with the help of the good people on here, the information you need
is all there,
Regards,
Alan.
"Harry Keijzer" <HarryKeijzer@discussions.microsoft.com> wrote in message
news:683AADA7-8889-4106-B1E3-7A8572C00CC9@microsoft.com...
> My system is infected with a "program" called Spyaxe and I cannot remove
> it.
> I keep seeing a little balloon in my taskbar that says I am infected. This
> stays around, even after I remove the program and its shortcut. When I
> restart the system, it re-installs itself. It also appears to bring in
> other
> trouble, such as something called "antivirus gold". Is there some
> step-by-step removal procedure "for dummies"? Somebody mentioned a
> noahdfear--any comments?
>
> Many thanks in advance, and best wishes for the New Year,
>
>
> --
> Harry Keijzer

From: "Carey Frisch [MVP]" <cnfrisch@nospamgmail.com>

| Microsoft Live Safety Center
| http://safety.live.com/site/en-US/default.htm
|
| Microsoft Windows AntiSpyware
|
http://www.microsoft.com/downloads/d...displaylang=en
|
| Here's what you can do to enhance the security on your PC
| http://www.microsoft.com/athome/secu...2/Default.mspx
|

Carey:

Please don't post the following...

Microsoft Live Safety Center
http://safety.live.com/site/en-US/default.htm

It is a Beta and on a scale from 1 to 10 it is a 2

If you are going to ost a online scanner post one that actually has a high catch rate.

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

I have been in communication with Randy Treir and I have been testing the site. Straight
talk -- it sucks !

I gave it a zoo and it had a 22% catch rate.

When I tested an "Exploit-WMF" sample Yesterday, these were the results...

AntiVir 6.33.0.70 12.29.2005 TR/Dldr.WMF.Agent.D
Avast 4.6.695.0 12.29.2005 Win32:Exdown
AVG 718 12.29.2005 Downloader.Agent.13.AI
Avira 6.33.0.70 12.29.2005 TR/Dldr.WMF.Agent.D
BitDefender 7.2 12.29.2005 Exploit.Win32.WMF-PFV.C
CAT-QuickHeal 8.00 12.29.2005 WMF.Exploit
ClamAV devel-20051123 12.29.2005 Exploit.WMF.A
DrWeb 4.33 12.29.2005 Exploit.MS05-053
eTrust-Iris 7.1.194.0 12.29.2005 Win32/Worfo.C!Trojan
eTrust-Vet 12.4.1.0 12.29.2005 Win32/Worfo
Ewido 3.5 12.29.2005 Downloader.Agent.acd
Fortinet 2.54.0.0 12.29.2005 W32/WMF-exploit
F-Prot 3.16c 12.29.2005 security risk or a "backdoor" program
Ikarus 0.2.59.0 12.29.2005 Trojan-Downloader.Win32.Agent.ACD
Kaspersky 4.0.2.24 12.29.2005 Trojan-Downloader.Win32.Agent.acd
McAfee 4662 12.29.2005 Exploit-WMF
Microsoft ?? 12.29.2005 no virus found
NOD32v2 1.1343 12.28.2005 Win32/TrojanDownloader.Wmfex
Norman 5.70.10 12.29.2005 no virus found
Panda 9.0.0.4 12.28.2005 Exploit/Metafile
Sophos 4.01.0 12.29.2005 Troj/DownLdr-NK
Symantec 8.0 12.29.2005 Download.Trojan
TheHacker 5.9.1.064 12.28.2005 Exploit/WMF
Trend Micro 135 12.29.2005 TROJ_NASCENE.D
UNA 1.83 12.29.2005 no virus found
VBA32 3.10.5 12.28.2005 no virus found


Today however it is causght...

Microsoft ?? 12.30.2005 Exploit:Win32/Wmfap

Just because you are a Microsoft MVP, please don't suggest a low quality product wjhen there
are high quality alternatives.
Especially when it is a security related issue !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

"Harry Keijzer" <HarryKeijzer@discussions.microsoft.com> wrote in message
news:683AADA7-8889-4106-B1E3-7A8572C00CC9@microsoft.com...
> My system is infected with a "program" called Spyaxe and I cannot remove
> it.

Searching google Spyaxe is apparently an anti spy ware program. Follow this
link to their home page.
http://www.spyaxe.com/index.php

If this is what you have did you install it at some time??

It is reported as being oversensitive and produces false positives maybe
accounting for the frequent balloons you are seeing????

Go to start/settings/control panel/ then add/remove programs. If it shows
up in the list uninstall it and reboot.

That doesn't work with this one, its the most insidious bugger I've ever
come across.
It's not so much a spyware program as a spy infection that demands that you
pay them to stop it driving you mad. Also the 'Malware' that it displays is
crap, just made up file names that aren't really on your system at all. Note
that as far as I am aware, most anti spyware programs like SpySweeper and
Microsoft Antivirus wont stop it, even if they find it. I speak from
experience.
It even uses the internal speaker to bleep the warning every time the
balloon pops up so you cant switch it off, and apparently its capable of
preventing your machine from booting up in Safe Mode to hamper attempts to
delete it although I didn't encounter this myself.
If you tried the marketing techniques of this scum anywhere else but on the
internet you'd wind up doing five years
Follow the advice of David H. Lipman, he knows what he's talking about on
this, he got rid of it for me,
Regards,
Alan.
"Spikey" <hedge_hogg@NOSPAMbtinternet.com> wrote in message
news:OaAoy8ZDGHA.3528@TK2MSFTNGP12.phx.gbl...
>
> "Harry Keijzer" <HarryKeijzer@discussions.microsoft.com> wrote in message
> news:683AADA7-8889-4106-B1E3-7A8572C00CC9@microsoft.com...
>> My system is infected with a "program" called Spyaxe and I cannot remove
>> it.
>
> Searching google Spyaxe is apparently an anti spy ware program. Follow
> this link to their home page.
> http://www.spyaxe.com/index.php
>
> If this is what you have did you install it at some time??
>
> It is reported as being oversensitive and produces false positives maybe
> accounting for the frequent balloons you are seeing????
>
> Go to start/settings/control panel/ then add/remove programs. If it shows
> up in the list uninstall it and reboot.
>
>

If you have SpyAxe, PSGuard, Smitfraud, Sinnaka Advertisments or detections
for Puper or Alemod that can not seem to be removed automatically, please
try this automated removal tool.

AntiPuper v1.1 by secured2k
http://secured2k.home.comcast.net/tools/AntiPuper.exe

What does this tool do?
This tool will attempt to delete several known Trojan files. These files are
modified by the malware authors and encrypted to avoid detection.
Fortunately, many of these tend to use the exact same file names. If the
files are in use, locked, protected, etc, this program will schedule Windows
to remove the files upon restarting.

This program will also remove some common security policies that are changed
by viruses and worms. Policies that lock out your desktop changes, windows
update, Windows Firewall, Explorer Run policies, Registry editing, and more
are all reset.

Finally, if you have an infected Alemod WININET.DLL file, this program will
try to copy a clean version from your Windows File Protection folder and
replace the bad copy on restart. If a backup copy can not be found, the tool
will quickly look for McAfee Antivirus files and attempt to clean a copy of
the file to replace the bad one on reboot. If all of this fails, you will
need to manually replace/clean your WININET.DLL file.





"Harry Keijzer" <HarryKeijzer@discussions.microsoft.com> wrote in message
news:683AADA7-8889-4106-B1E3-7A8572C00CC9@microsoft.com...
> My system is infected with a "program" called Spyaxe and I cannot remove
> it.
> I keep seeing a little balloon in my taskbar that says I am infected. This
> stays around, even after I remove the program and its shortcut. When I
> restart the system, it re-installs itself. It also appears to bring in
> other
> trouble, such as something called "antivirus gold". Is there some
> step-by-step removal procedure "for dummies"? Somebody mentioned a
> noahdfear--any comments?
>
> Many thanks in advance, and best wishes for the New Year,
>
>
> --
> Harry Keijzer

In article <uvY3VWaDGHA.1204@TK2MSFTNGP09.phx.gbl>, ilovepcbutts1
@withapassion.com says...
> NNTP-Posting-Host: ppp-69-237-53-123.dsl.bkfd14.pacbell.net 69.237.53.123

I see that you still have no means to prove you didn't pilfer the apps
and that you still can't post with your real name to MS Usenet services.

Impersonating me does not help your case, but it's funny that you feel
the need to do it - I've not see anyone that wanted to impersonate you.

--

spam999free@rrohio.com
remove 999 in order to email me

"Alan" <alan111@ntlworld.com> wrote in message
news:uIb$PUaDGHA.2956@TK2MSFTNGP14.phx.gbl...
> Follow the advice of David H. Lipman, he knows what he's talking about on
> this, he got rid of it for me,

Have filed for future reference. Lets hope I never need it.