Back to Forums








View Full Version : SpyAxe - it's wicked!


Curio
December 20th, 2005, 18:58 PM
Seeing quite a bit of SpyAxe dodgy adware infestation at the moment and it can be a bit of a git for the uninitiated. Why? It doesn't run as a program and there are no traceable startup entries but it's there all the time. Seems to inject itself into Explorer so you can't terminate it and it can do naughty things without you being able to stop it. My generic fix at the moment is to open %systemroot%\system32\ and look for dll files listing them by date modified - the last one (most recent) is likely to be the offending dll so you must rename or delete it. Try renaming it (so far had svchosts.dll and ioctrl.dll) and if you can't rename it then it probably is the right one - use killbox to delete on reboot, you already know how to do that.
Some sites I have seen tell you to run the uninstaller in %programfilesdir%\spyaxe\ - don't waste your time it just deletes the program files but the dll remains loaded in Explorer and continues to nag you like a woma... well lets say it continues to nag you a lot.
Usually has associated other spyware adware like SmitFraud and searchexe but they are easy enough to remove so I won't bore you with the details.

FastGame
December 21st, 2005, 00:19 AM
Did you get a SpyAxe sample or actually caught it on the net ?

You can get a nice removal tool and instructions Here (http://www.precisesecurity.com/adware-spy/awsax-008dec.htm)

Curio
December 21st, 2005, 07:58 AM
I don't have it thanks - I have been removing it from peoples computers, the tool you refer to runs the spyaxe uninstaller which does not remove the spyaxe nagger. SpyAxe the program does get removed but the naggy bit isn't, or I should say it wasn't when I tried it a few days ago - perhaps they have updated the tool since then.
I have looked into it a bit more and the nagger appears to be started via a scheduled task - there is now a good technical description on 2-spyware which I believe is something to do with pc-tools. MWAV also now (as of 20th Dec) removes the little bits of SpyAxe so it doesn't re-appear when you reboot.
It's still nice to do it manually though - so you are ready for the next variant plus at the time there were no working removal tools or guides on the net.

Merry Xmas

Aloone_Jonez
December 25th, 2005, 13:50 PM
Have you checked the registry and services.msc?