Malware/Spyaxe trouble

[Guest]

Every 10 minutes or so Antispyware asks to remove the threat Spyaxe, i remove
it, reboot, but it comes back everytime i restart, i've done system scans
also. In my system tray i have a "your computer is infected" bubble that will
not go away. saying i have a dangerous malware infection. and when i click on
it , it sends me to where i can buy Spyaxe. How do i get rid of this!!!!!!!
this is the only virus antispyware hasnt been able to take care of. Popups
happen even when explorer is closed everyone 10 minutes or so also. If you
know a solution please respond or email me at (e-mail address removed) .
thankyou!

 

[Guest]

Also, when i double click on the microsfot antispyware incon in the system
tray...it says i am installing microsoft office! i have to cancel it, then
everything works, strange, i dont have the CD in or anything

 

[Dave M]

Jason;
About a 14 threads below this one you'll find 5 methods of dealing with spyaxe
in:
Subject: SPYAXE, SPYTROOPER Phishing Scam
Date: Mon, 12 Dec 2005 10:42:02 -0800

 

[Guest]

I am having the same problem but it is with spy sherrif

 

[Dave M]

SmitRem is a tool created to remove the Trojan-Spy, HTML.Smitfraud.c malware
infection and it's

variants, AntivirusGold, PSGuard Spyware Remover, SpySheriff, Spy Trooper,
SpyAxe, and Security Toolbar.

These infections are known as Desktop Hijackers and make many unwanted changes
to a user's computer.

They are also difficult to remove. The effects of each of the above variants
varies, in some cases infecting the

system file wininet.dll and/or disabling the Task Manager in addition to taking
over the desktop. Included is

the repair of all of the known registry changes made by these hijackers, as well
as the removal of the

associated files and folders created. Panda ActiveScan online should be run
following the use of this tool,

since it can detect and often repair anything not found and removed with the
tool.


- http://noahdfear.geekstogo.com/

 

[Guest]

I was infected with the Smitfraud trojan and went through all the lengthy and
costly steps: smitRem, followed by Ad-aware, followed by ewido, evn
Microsoft's Antispyware (which doesn't even flag the offending files). None
of them worked. Ewido finds all the files and you can even pretend you are
quarantining them. But they come right back afterwards. I cannot get rid of
this malware and cannot find anything in Microsoft's official press about it.
At this point my system will not even allow me to boot up in Safe Mode. I
applaud the programmer who wrote the code to go after it but it didn't work.
What next?

Matt Brunner

 

[Dave M]

Matt hi;
Since you used SmitRem to remove that Trojan, you followed the instructions to
be guided by a specialist, right?

"I do not recommend using the tool without guidance from a qualified malware
removal specialist!"

http://noahdfear.geekstogo.com/

Such specialized help can be obtained for free on any of these HijackThis forums
(Randy Knobloch):
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)