During last few months a lot of corrupt anti-spyware vendors and their numerous affiliates began to use an illegal technique to promote and distribute rogue products. They started to spread specific parasites like trojans, adware, browser and desktop hijackers that display pop-ups, advertisements, notifications and messages alerting victims about spyware infection and encouraging to downloading and installing a particular corrupt anti-spyware including the infamous SpySheriff, PSGuard, WorldAntiSpy and RazeSpyware. Messages and windows that pests show look like common system alerts generated by the Microsoft Windows operating system. Although this technique is quite simple and relatively old, it is still very effective, because it is targeted to inexperienced and novice users, who are in the majority.
Yet another corrupt anti-spyware program recently started being distributed that way. It is SpyAxe, initially classified by 2-Spyware.com research center as a reliable application. The program appeared somewhere about the end of October. We have tested the application and it passed all our tests and produced sufficiently good results. But after few weeks, starting from November 8, the SpyAxe vendor and/or its affiliates began to use deceptive and aggressive advertising methods implemented in certain trojans. We received numerous user reports and complaints stating that they are continuously receiving the following warning message:
The text in a message may vary, but its purpose is always the same. It works as a link leading to www.spyaxe.com, which is the official web site of SpyAxe. Messages are displayed by the taskbar program that apparently is a variant of the TopAV trojan or similar pest. The parasite looks like a standard Windows update icon. Its main file is svchosts.dll located in the Windows directory, which typically is C:\Windows or C:\Winnt.
The SpyAxe vendor denies all illegal distribution charges and even provides the uninstall tool. However, we do not recommend using it. SpyAxe victims should rely on recommended anti-spyware tools or try to manually get rid of the parasite.
SpyAxe manual removal instructions
November 22nd, 2005 at 4:10 am
Which is the best FREE program can I use to remove SPY AXE ?
November 22nd, 2005 at 11:12 am
I need help to remove spyaxe from my pc. I removed the svchosts.dll, but every time I click on internet it go’s to this website http://www.updateyoursystem.com/. need help to remove this from my pc.
Thanks
mark
November 22nd, 2005 at 1:33 pm
Please ask your questions at 2-Spyware.com forums in the Removal of spyware, adware and other parasites category.
November 26th, 2005 at 12:47 am
I dropped into MSDOS (hopefully your using FAT32 and not NTFS)
Go to \windows\system32 and delete mssearchnet.exe, nvctrl.exe and replace them with an empty text file:
copy con mssearchnet.exe
ctrl Z
repeat for creating an empty nvctrl.exe file as well…
Now restart Windows, the buggers will pop up some MSDOS windows and think that the files still exist and are there, now run your spyware killer (I use Spybot Search & Destroy) to remove the nasties…
Next run regedit and remove all incidences of the above files, plus remove all entries for spyaxe as well,
Reboot and run your spyware killer again to ensure their removal…
Next issue is with the damned IE redirec to updateyoursystem.com which I haven’t found how its doing this little trick as I’ve corrected the regedit setting of the start page, yet it’s still coming up somehow, so some service appears to have been altered.
This is one majorly nasty suite of prog’s working in concert and scary as hell that they’ve infested the system so deeply on so many points.
Curt
November 30th, 2005 at 3:05 pm
I ran the uninstall program that spyaxe sent me after i got infected and it torched my computer. At its current state, my computer won’t start up. Now what do I do and who the heck are these people that are doing this?
December 3rd, 2005 at 11:35 pm
i have tried using every means possible. it is also has aka’s
spytrooper, spyguard and of course allready mentioned spy sheriff.
spybot S&D detected it and on restart found it again. removed it, immunized, and blocked it.
it is also on my windows pop blocker for IE6.2, to no avail it is still on taskbar.
if there is legal ramifications let me know immediately.
i would be willing to start a CLASS ACTION LITIGATION against this company.
i think 500 million might change the next guys mind.
i have deleted so much of my registry in regedit and services in msconfig, that i cannot even open my own company files.
i can’t update or convert my Outlook account, and i lag on the internet like dial up.
if i could find this company local to california. i would knock on this guys home and office door everyday for 6 times a day just to make sure he can’t sleep!
December 4th, 2005 at 12:24 am
here is the feed back page for spytrooper helpdesk.
which happens to look exactly like the helpdesk for SPYAXE
go to this page and send five emails of feedback.
i will be doing this the rest of the night.
maybe when their email is full and their server crashes from the load they will listen to u
http://www.spytrooper.com/helpdesk.php
if not email me john@suddenmoves.us and i will start a class action list on my website
http://www.suddenmoves.us
December 4th, 2005 at 1:18 pm
here is interesting tidbit from the FTC:
Legislation
Some forms of spyware are illegal under laws covering unfair trade practices and computer crimes, although no one has been prosecuted to date. In October the FTC filed the first suit that accuses a company of exploiting a browser vulnerability to infect computers with spyware and pop-up ads and then trying to sell programs to remove them.
Legislative action has moved into high gear at both the state and federal levels. A recently enacted California law prohibits the deceptive collection of personal information such as passwords or credit card numbers. The pending Senate Spy Block Act requires spyware distributors to provide detailed disclosure before installation. The House’s pending Internet Spyware Prevention Act (I-SPY) threatens five years of imprisonment and budgets $10 million for enforcement. Another bill authorizes the FTC to levy $3 million in fines on violators.
try copy/paste this article into every help desk in spy trooper, spyaxe and spyguard.
spy trooper sent me a 3 day trial in the email last night after 50 helpdesk request from me. explaining they are not affiliated with spyaxe.
but when i deleted spyaxe it came back, but when i clicked on the icon, it opened a webpage to spytrooper.
December 7th, 2005 at 5:08 pm
I’ve had this bloody thing on my computer for about 2 weeks now, and I keep removing it but it
gets back in again!!
If anyone figures out how to get rid of it please let me know.
Good luck
December 9th, 2005 at 6:34 am
2-Spyware.com already provides SpyAxe manual removal instructions. Following those instructions will completely remove SpyAxe from your system.
December 12th, 2005 at 3:28 pm
Unfortunately for me i have deleted everything the instructions say to delete, ive edited every trace of it from the registry, the exe files no longer exist on my hard drive nor do they show up in my processes, yet the spyware is still there, still popping up still frustrating me to the point of insanity, how can these people continue to get away with this?
December 12th, 2005 at 11:51 pm
I got the damn thing, and found most of what I found through Google to be useless for removal. Finally said to hell with it and did a system restore on XP. All gone, so far………. fingers crossed.
December 20th, 2005 at 12:02 pm
Just an update. I have managed to remove spyaxe from my computer by following the removal instructions and it has been successful up to now (touch wood)!!
The only thing I can’t get rid of is that when I click my homepase it still goes to the spyaxe homepage. To overcome this I have just put a seperate shortcut on my desktop to Yahoo instead of Google and this has been working fine up to now as well.
The annoying thing is that I should not have to do this as I should be able to use whatever homepage I want, and I hate the fact that they have been able to stop me!!
If anyone has been able to figure out how to overcome this please let me know.
Cheers
January 2nd, 2006 at 5:12 pm
I recommend reformatting your hard drive. My computer was infected with SpySheriff last week and went crazy. Just be sure to make backup copies of all the files you want to save before you reformat as this process eraxes everything on your computer. You will also have to download and reinstall all programs such as Windowes Media Player, Shockwave, etc. This was much faster for me than trying to remove it and my computer is running just fine.