I had this same problem and found the cure to the SpyAxe popup
activity! I tried SpyBot Search and Destroy and Ad-aware, I have
Mcaffee Internet Security Suite and it didn't do anything, and that
always catches viruses, and I used various other programs virtually all
of the top of the line tools, but nothing fixed the problem.
SpyAxe states that they have been getting a lot of complaints about
illegal affiliates infecting computers with Trojans forcing people to
by their product in order to remove the Trojan that's advertising their
product. SpyAxe is a ligament company I guess, but there are some evil
affiliates that will do anything to get commission from these
legitimate companies, such as SpyAxe, so they create these annoying
Trojans like this to force people to buy things, basically holding your
computer hostage.

SpyAxe has provided a simple fix that removes these types of Trojans
for free and believe it or not it really works. Here are the
instructions:
------------------
In order to clean your PC from infections related to Spyware Axe
product, please follow the instructions below:

1) Save the "Uninstallers.zip" program from
http://www.spyaxe.com/uninstall/uninstallers.zip to your desktop or
HDD. (I was a
little hesitant to do this at first, but I did it anyways because I
tried everything else and it REALLY did remove the program from
my computer, so don't worry this REALLY works. Really!)

2) Extract the file "illegal_adv_uninstall1.exe" to your desktop or
your HDD using WinZip.

3) Execute the program by double-clicking with your mouse. Nothing
special happens when you run the program (you don't even see it run)
and you'll think nothing ran, but just Reboot your PC and you will
notice that your PC is now clean.

I was just about to re-install XP and then I found this in a forum at
sillydog.org, and it really just did work.

From: <jaredwilli@gmail.com>

| I had this same problem and found the cure to the SpyAxe popup
| activity! I tried SpyBot Search and Destroy and Ad-aware, I have
| Mcaffee Internet Security Suite and it didn't do anything, and that
| always catches viruses, and I used various other programs virtually all
| of the top of the line tools, but nothing fixed the problem.
| SpyAxe states that they have been getting a lot of complaints about
| illegal affiliates infecting computers with Trojans forcing people to
| by their product in order to remove the Trojan that's advertising their
| product. SpyAxe is a ligament company I guess, but there are some evil
| affiliates that will do anything to get commission from these
| legitimate companies, such as SpyAxe, so they create these annoying
| Trojans like this to force people to buy things, basically holding your
| computer hostage.
|
| SpyAxe has provided a simple fix that removes these types of Trojans
| for free and believe it or not it really works. Here are the
| instructions:
| ------------------
| In order to clean your PC from infections related to Spyware Axe
| product, please follow the instructions below:
|
| 1) Save the "Uninstallers.zip" program from
| http://www.spyaxe.com/uninstall/uninstallers.zip to your desktop or
| HDD. (I was a
| little hesitant to do this at first, but I did it anyways because I
| tried everything else and it REALLY did remove the program from
| my computer, so don't worry this REALLY works. Really!)
|
| 2) Extract the file "illegal_adv_uninstall1.exe" to your desktop or
| your HDD using WinZip.
|
| 3) Execute the program by double-clicking with your mouse. Nothing
| special happens when you run the program (you don't even see it run)
| and you'll think nothing ran, but just Reboot your PC and you will
| notice that your PC is now clean.
|
| I was just about to re-install XP and then I found this in a forum at
| sillydog.org, and it really just did work.

Unfortunately that will NOT be enough !

There are various Trojans associated with SpyAxe and assuming that removes SpyAxe, it won't
remove the infectors that may have ayromatically installed it.

SpyAxe is malware. It is rarely advisable yo use an uninstaller from a vendor who creates
that malware.

Two part reply..

Perform Part 1 and then perform Part 2.

Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

Alternate:

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

David,

You are very knowledgable on this topic, but I was a bit confused by this
post. Is Spyaxe synonymous with PSguard, and if so, does SmitFraud work with
MCE 2005? I seem to have contracted PSguard (detected with ad-aware), and
have found several references to SmitFraud as the solution to my problem, but
despite having run the batch file three times now, it doesn't seem to clear
the problem.

I suspected that perhaps a change in directory structure or file names might
cause the batch file to fail, and I would appreciate your confirmation that
these instructions are applicable to MCE.

Thanks!

BH

"David H. Lipman" wrote:

> From: <jaredwilli@gmail.com>
>
> | I had this same problem and found the cure to the SpyAxe popup
> | activity! I tried SpyBot Search and Destroy and Ad-aware, I have
> | Mcaffee Internet Security Suite and it didn't do anything, and that
> | always catches viruses, and I used various other programs virtually all
> | of the top of the line tools, but nothing fixed the problem.
> | SpyAxe states that they have been getting a lot of complaints about
> | illegal affiliates infecting computers with Trojans forcing people to
> | by their product in order to remove the Trojan that's advertising their
> | product. SpyAxe is a ligament company I guess, but there are some evil
> | affiliates that will do anything to get commission from these
> | legitimate companies, such as SpyAxe, so they create these annoying
> | Trojans like this to force people to buy things, basically holding your
> | computer hostage.
> |
> | SpyAxe has provided a simple fix that removes these types of Trojans
> | for free and believe it or not it really works. Here are the
> | instructions:
> | ------------------
> | In order to clean your PC from infections related to Spyware Axe
> | product, please follow the instructions below:
> |
> | 1) Save the "Uninstallers.zip" program from
> | http://www.spyaxe.com/uninstall/uninstallers.zip to your desktop or
> | HDD. (I was a
> | little hesitant to do this at first, but I did it anyways because I
> | tried everything else and it REALLY did remove the program from
> | my computer, so don't worry this REALLY works. Really!)
> |
> | 2) Extract the file "illegal_adv_uninstall1.exe" to your desktop or
> | your HDD using WinZip.
> |
> | 3) Execute the program by double-clicking with your mouse. Nothing
> | special happens when you run the program (you don't even see it run)
> | and you'll think nothing ran, but just Reboot your PC and you will
> | notice that your PC is now clean.
> |
> | I was just about to re-install XP and then I found this in a forum at
> | sillydog.org, and it really just did work.
>
> Unfortunately that will NOT be enough !
>
> There are various Trojans associated with SpyAxe and assuming that removes SpyAxe, it won't
> remove the infectors that may have ayromatically installed it.
>
> SpyAxe is malware. It is rarely advisable yo use an uninstaller from a vendor who creates
> that malware.
>
> Two part reply..
>
> Perform Part 1 and then perform Part 2.
>
> Use the alternate if the first two parts are ineffective...
> Note: Alternate only for Win2K, WinXP and Win2003 Server
>
> Part 1
> -----------
>
> Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
> http://noahdfear.geekstogo.com/click...click.php?id=1
>
> http://www.bleepingcomputer.com/forums/topic36868.html
>
>
> Part 2
> -----------
>
> Download SmitFraud.exe from the URL --
> http://www.ik-cs.com/programs/virtools/SmitFraud.exe
>
> Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
> Choose; Unzip
> Choose; Close
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to enable WGET.EXE to download the needed McAfee related files.
>
> Execute; c:\mcafee\clean.bat
> { or Double-click on 'Clean Link' in c:\mcafee }
>
> A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
> end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
> It is suggested that you move the report out of c:\mcafee before performing another scan.
>
> Alternate:
>
> Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.
>
> http://secured2k.home.comcast.net/tools/AntiPuper.exe
>
> http://forums.mcafeehelp.com/viewtopic.php?t=65072
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>
>

From: "Bryan Hesters" <Bryan Hesters@discussions.microsoft.com>

| David,
|
| You are very knowledgable on this topic, but I was a bit confused by this
| post. Is Spyaxe synonymous with PSguard, and if so, does SmitFraud work with
| MCE 2005? I seem to have contracted PSguard (detected with ad-aware), and
| have found several references to SmitFraud as the solution to my problem, but
| despite having run the batch file three times now, it doesn't seem to clear
| the problem.
|
| I suspected that perhaps a change in directory structure or file names might
| cause the batch file to fail, and I would appreciate your confirmation that
| these instructions are applicable to MCE.
|
| Thanks!
|
|


Yes, a PC infected with SpyAxe and/or the SmitFruad Trojan can be infected with PS Guard.

What is "MCE 2005" ? I don't don't know what that is.

Follow all the directions in the following tools.

You may have to run them in Safe Mode as well as in Normal Mode.

Two part reply..

Perform Part 1 and then perform Part 2.

Use the alternate if the first two parts are ineffective...
Note: Alternate only for Win2K, WinXP and Win2003 Server

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.

Alternate:

Part 1
-----------

Secured2K's SpyAxe, PSGuard, Smitfraud, Sinnaka and Alemod removal tool.

http://secured2k.home.comcast.net/tools/AntiPuper.exe

http://forums.mcafeehelp.com/viewtopic.php?t=65072


Part 2
-----------

Swandog46's Apropos Adware/RootKit remover
http://swandog46.geekstogo.com/aproposfix.exe


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

From: "demiculo" <shachar.bretstein@gmail.com>

| Hi David,
|
| been strugling with th removal of the spyaxe for the last 10 hours.
| I might be imagining but could there be a newer version of the spyaxe
| malware?
| I went through steps 1 and 2 as well as the alternate 1 & 2 for several
| times.
| I started by following this instructions:
| http://malwareremoval.com/plog/index...Id=48&blogId=3
|
| currently, after I Installed microsoft update it seems like spyaxe
| doesn;t install itself but the annoying tray icon and the pop up baloon
| just won't go.
| the reason why I suspect a new version is the fact that I could not
| locate on my computer none of the files (svchosts.dll, ioctrl.dll)
| which were mentioned in all of the threads I went through.
|
| Any ideas?
|
| Additional info: WinXP Profoessional, default browser
| FireFox....anything else?
|


Please copy the contents of the following log; C:\mcafee\ScanReport.HTML
and paste the contents in your reply.


The URL...
http://malwareremoval.com/plog/index...Id=48&blogId=3

basically has you use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click...click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html

In the instructions in the previous part of the thread, did you run all four of the
utilities in both Normal Mode and in Safe Mode ?

Also, it would be helpful to read the following information…
“How to perform a clean boot in Windows XP”
http://support.microsoft.com/kb/310353



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

PCBUTTS1 Alert:

Only download software you can validate as uncompromised - in the case
of non-vendor site you have no guarantee that the files are unmodified
or uncompromised. Anyone providing a link to a non-vendors site with a
direct download should not be trusted, the vendors sites are the safest
place to download their application.

No person of sound mind would download files from a hack site that
requires a password to access the unknown files when they are available
directly from the vendors.

Always remember - only download files from Trusted Sites.

DO NOT DOWNLOAD REG files from known sites.

--

spam999free@rrohio.com
remove 999 in order to email me

In article <43b2a96a$0$18340$c3e8da3@news.astraweb.com>,
msngc@hotmail.com says...
> In your limited knowledge of computers you can't tell a page link from a
> download link. Your post just shows how stupid and obsessed you are. You are
> a sick person, stop Stalking me Leythos.

Sure I can, but the page (and I didn't look) would most likely contain
something that unknowing user would download, since you have a history
of it.

The warning stands - downloading from a unknown site is a bad move and
always a risk.


> "Leythos" <void@nowhere.lan> wrote in message
> news:2wosf.245940$tD4.30703@tornado.ohiordc.rr.com ...
> > PCBUTTS1 Alert:
> >
> > Only download software you can validate as uncompromised - in the case
> > of non-vendor site you have no guarantee that the files are unmodified
> > or uncompromised. Anyone providing a link to a non-vendors site with a
> > direct download should not be trusted, the vendors sites are the safest
> > place to download their application.
> >
> > No person of sound mind would download files from a hack site that
> > requires a password to access the unknown files when they are available
> > directly from the vendors.
> >
> > Always remember - only download files from Trusted Sites.
> >
> > DO NOT DOWNLOAD REG files from known sites.
> >
> > --
> >
> > spam999free@rrohio.com
> > remove 999 in order to email me
>
>
>

--

spam999free@rrohio.com
remove 999 in order to email me

Hi Gerry, Hi David Lipman

since I was reading a lot of messages from people who managed to remove
the SpyAxe with the supported tools, I didn't to go on with the manual
deletion.
I got to the point where I was desperate/pissed enough to go manual.
results are great, no residues of the SpyAxe nor the annoying pop up
balloon.
Some points that you might find interesting:
1. NONE of the files (ioctrl.dll, svchosts.dll etc) existedon my
computer nor in the registry.
2. After removing the traces of SpyAxe from the registry in safe mode
and rebooting to normal mode the Ewido caught the SpyAxe infection in
the following dll c:\windows\system32\wbeconm.dll
3. I went back to safe mode and went through the process again. while
doing so, I discovered a file called sa1.exe in the C:\Documents and
Settings\[user name]\Local Settings\Temp directory which described as
SpyAxe installer.
After removing this file as the SpyAxe traces - I'm all clean.

Thanks for your help, and I hope you can benefit something from the
info I supplied.

Hi Gerry, Hi David Lipman

since I was reading a lot of messages from people who managed to remove
the SpyAxe with the supported tools, I didn't to go on with the manual
deletion.
I got to the point where I was desperate/pissed enough to go manual.
results are great, no residues of the SpyAxe nor the annoying pop up
balloon.
Some points that you might find interesting:
1. NONE of the files (ioctrl.dll, svchosts.dll etc) existedon my
computer nor in the registry.
2. After removing the traces of SpyAxe from the registry in safe mode
and rebooting to normal mode the Ewido caught the SpyAxe infection in
the following dll c:\windows\system32\wbeconm.dll
3. I went back to safe mode and went through the process again. while
doing so, I discovered a file called sa1.exe in the C:\Documents and
Settings\[user name]\Local Settings\Temp directory which described as
SpyAxe installer.
After removing this file as the SpyAxe traces - I'm all clean.

Thanks for your help, and I hope you can benefit something from the
info I supplied.

From: "demiculo" <shachar.bretstein@gmail.com>

| Hi Gerry, Hi David Lipman
|
| since I was reading a lot of messages from people who managed to remove
| the SpyAxe with the supported tools, I didn't to go on with the manual
| deletion.
| I got to the point where I was desperate/pissed enough to go manual.
| results are great, no residues of the SpyAxe nor the annoying pop up
| balloon.
| Some points that you might find interesting:
| 1. NONE of the files (ioctrl.dll, svchosts.dll etc) existedon my
| computer nor in the registry.
| 2. After removing the traces of SpyAxe from the registry in safe mode
| and rebooting to normal mode the Ewido caught the SpyAxe infection in
| the following dll c:\windows\system32\wbeconm.dll
| 3. I went back to safe mode and went through the process again. while
| doing so, I discovered a file called sa1.exe in the C:\Documents and
| Settings\[user name]\Local Settings\Temp directory which described as
| SpyAxe installer.
| After removing this file as the SpyAxe traces - I'm all clean.
|
| Thanks for your help, and I hope you can benefit something from the
| info I supplied.

I did and my tool has been updated. Thanx !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm