SpyAxe. How to remove? (Uninstall guide)
SpyAxe is a trojan, which displays one or two icons in the system tray. These icons show a message saying that the compromised system is infected with spyware parasites and asking the user to download and install an anti-spyware program (see the snapshot below), which actually is the infamous SpyAxe 3.0, corrupt illegally distributed spyware remover. Once the user clicks on such message, the trojan opens the anti-spyware’s official web site. It may also try to download the application automatically. SpyAxe 3.0 may also change the desktop background. The trojan automatically runs on every Windows startup.
People try to find information about SpyAxe 3.0 by various names and file relationships. They they try to use combinations: spy axe, spyax, zlob, needupdate, etc. All these names usually mean infections of the SpyAxe parasite. This threat tries to mutate and often uses different file names. Infections started with the use of svchosts.dll file, later with ioctrl.dll, and the last known infections are with the use of webconm.dll file.
Other similar parasites: SpyAxe, SpywareStrike, SpyFalcon, Spyware Quake
SpyAxe manual removal:
mscornet.exe,mssearchnet.exe,nvctrl.exe,spyaxe.exe
Delete registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler{E802FFFF-8E58-4D2C-A435-8BEEFB10AB77}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObject{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
HKEY_CLASSES_ROOTCLSID{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
HKEY_CURRENT_USERSoftwareClassesCLSID{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3E9B951E-6F72-431B-82CF-4A9FBF2F53BC}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7CAF96A2-C556-460A-988E-76FC7895D284}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{E9CCF15D-4C68-4B5A-9E9A-8E12E4BD39BD}
Unregister DLLs:
ioctrl.dll,svchosts.dll,webconm.dll,wbeconm.dll
Delete files:
mscornet.exe,mssearchnet.exe,nvctrl.exe,spyaxe.exe,ioctrl.dll,svchosts.dll,webconm.dll,wbeconm.dll,hp[X].tmp
Delete directories:
C:Program FilesSpyAxe
C:WindowsSystem1024
C:WindowsSystem321024
C:WinntSystem321024
About the author
If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.