SpyAxe.net spyware I can't remove

[Guest]

Had SpyAxe.net get into my computer on Friday. I cannot get rid of it. Have
usedMicrosoft Antispyware, Spybot, and SpywareDetector for no help. There
are two icons on the right side of the task bar in the notification area that
continue to pop up little boxes telling me my computer is infected. Anyone
got any good ideas how to get into the task bar and get rid of those icons or
how to figuer where the application is located?

 

[KB]

Had SpyAxe.net get into my computer on Friday. I cannot get rid of it. Have
usedMicrosoft Antispyware, Spybot, and SpywareDetector for no help. There
are two icons on the right side of the task bar in the notification area that
continue to pop up little boxes telling me my computer is infected. Anyone
got any good ideas how to get into the task bar and get rid of those icons or
how to figuer where the application is located?

Info taken from here: http://www.thex.com/rd/2005/11/26/firefox-spyaxe/

Anyway, here is the process I took to get rid of the SpyAxe *cursing noises*, so others
can do it for themselves.

1. Download HiJackThis;
2. Reboot the computer into safe mode;
3. When in Safe Mode, remove SpyAxe.
4. Run HiJackThis, my “infection†was HomepageBHO, delete it;
5. Run regedit and find this key:
HKEY_LOCAL_MACHINE\
SOFTWARE\
Microsoft\
Windows\
CurrentVersion\
policies\
Explorer\
run

You’re looking for the mssearchnet and nvctrl entries - delete them outright (right
click, delete).
6. Reboot

That’s what fixed it for me. If this works for you, add a comment to the thread. If not,
say so, we can work on it some more.

 

[Guest]

I tried what you said, didnt work for some reason. I removed SpyAxe using
the remove programs, assumed that is what you ment. When I ran regedit, i
found the nvctrl entrie and deleted it. Found the msseqrchnet to the right
side inside parens i believe and deleted that also. Ran HijackThis and
deleted HomepageBHO. I looked into safe mode twice and the HomepageBHO or
stuff in regedit weren't there the second time I looked. Any ideas? The
little icons are still cursing!!

 

[KB]

I tried what you said, didnt work for some reason. I removed SpyAxe using
the remove programs, assumed that is what you ment. When I ran regedit, i
found the nvctrl entrie and deleted it. Found the msseqrchnet to the right
side inside parens i believe and deleted that also. Ran HijackThis and
deleted HomepageBHO. I looked into safe mode twice and the HomepageBHO or
stuff in regedit weren't there the second time I looked. Any ideas? The
little icons are still cursing!!

I have not used this program, but some in other newsgroups swear by it. Find it here:
http://malwareremoval.com/plog/index.php?op=ViewArticle&articleId=48&blogId=3

The link to download it is just above the first large graphic.

Good luck,

Post Back.

 

[Guest]

Keep that page handy for SpyAxe questions. It worked I've been pop up free
of cursing fro 7 minutes now after 7 hours of trying. I appreciate your
being around today to help, and to direct me to the SpyAxeFix page. Now if
we just knew where SpyAxe.net was located we could go there and show them how
much we like them and wqnt them to experience the same type of frustration.
I recommend you click on that web page you sent me to lots of interesting
comments. Tanks again.

 

[arne.smeyers]

I'm sorry still bothering everyone here. But I tried everything to
remove SpyAxe, but it doesn't word. Safemode, uninstall from spyaxe
itself, Smitrem, HijackThis, Regedit...
It stil pops up. Anybody got another idea??? Re-installing my pc is not
an option...

Greetings,

Arne


(e-mail address removed) schreef:

 

[Leythos]

I'm sorry still bothering everyone here. But I tried everything to
remove SpyAxe, but it doesn't word. Safemode, uninstall from spyaxe
itself, Smitrem, HijackThis, Regedit...
It stil pops up. Anybody got another idea??? Re-installing my pc is not
an option...

Subject: Re: Help....SpyAxe - cured!

Follow Dave's instructions in the above named thread.

 

[richardl6]

This is how I got rid of SpyAxe ...

I first tried many tools, blokkers and crap that where described in
forum
-> nothing helped, popup kept coming and SpyAxe reinstalled again and
again.

1) Let Microsoft Antispyware detect SpyAxe and choose remove
2) Do not reboot yet
3) End the process "Explorer" using ctrl+del
4) Start the command prompt via Task Manager (File->Run and type CMD)
5) Move to c:\windows\system32 (cd\windows\system32)
6) Remove the file "IOCTRL.DLL" (del ioctrl.dll)
7) Now reboot your computer
8) After reboot run a full scan with Microsoft Antispyware and do a
disk cleanup

This solved the problem for me !

Leythos schreef:

 

[David H. Lipman]

From: <[email protected]>

| I'm sorry still bothering everyone here. But I tried everything to
| remove SpyAxe, but it doesn't word. Safemode, uninstall from spyaxe
| itself, Smitrem, HijackThis, Regedit...
| It stil pops up. Anybody got another idea??? Re-installing my pc is not
| an option...
|
| Greetings,
|
| Arne
|


Two part reply...

Part 1
-----------

Use noahdfear's SmitFraud and SpyAxe removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click counter/click.php?id=1

http://www.bleepingcomputer.com/forums/topic36868.html


Part 2
-----------

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.


* * * Please report back your results * * *

 

[richardl6]

Want to get rid of SpyAxe popup ????

Smitfraud and many other crap didn't solve it
Read my advice above, that's the only way to get rid of SpyAxe ...

Just clean all files using any AntiSpyware program (I recommend
Microsoft Antispyware) ...

But all of those cannot remove the process doing it at all completly
....

After that you should delete iocrtl.dll from windows system32 directory
....

None of all crap spyware/hijackthis/adblocker/popupblocker/ etc ...
does that

Once you deleted IOCTRL.DLL the problem is solved

Don't pay any attention to time-sucking scans and money-making software
(who aim to delete it)

All those silly programs don't see that ioctrl.dll is the only thing
that should be removed after cleaned all other files !

Greetz,
Shubert

 

[boater]

richard. Being a somewhat older silver surfer and prehaps not up to
speed, I followed your instructions on how to get rid of this sh-t
SpyAxe that is making me older and more grumpy by the day.
Downloaded Microsoft Antispyware Beta 1 and run a search - nothing came
up. went to c:\windows\system32 and found "IOCTRL.DLL" pressed delete
and the message came back:
ERROR DELETING FILE - CANNOT DELETE FILE IOCTRL ACCESS DENIED. MAKE
SURE DISC IS NOT FULL ETC ETC.
Any thoughts.
Regards
Bill

 

[David H. Lipman]

From: "boater" <[email protected]>

| richard. Being a somewhat older silver surfer and prehaps not up to
| speed, I followed your instructions on how to get rid of this sh-t
| SpyAxe that is making me older and more grumpy by the day.
| Downloaded Microsoft Antispyware Beta 1 and run a search - nothing came
| up. went to c:\windows\system32 and found "IOCTRL.DLL" pressed delete
| and the message came back:
| ERROR DELETING FILE - CANNOT DELETE FILE IOCTRL ACCESS DENIED. MAKE
| SURE DISC IS NOT FULL ETC ETC.
| Any thoughts.
| Regards
| Bill

Bill:

Please try the following tool.
It should handle the c:\windows\system32\IOCTRL.DLL issue.


Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
It is suggested that you move the report out of c:\mcafee before performing another scan.


Please Copy and Paste the contents of the HTML Log file; C:\mcafee\ScanReport.HTML in your
reply.

* * * Please report back your results * * *

 

[Lisa Simpson]

get super adblocker - it removes this piece of crap.

 

[maitre]

Hi,
You could find information about spyaxe in:
www40. brinkster. com/ spyaxe/ spyaxe-info. asp

thanks Maitre

 

[maitre]

Hi,
You could find information about spyaxe in:
http://www40.brinkster.com/spyaxe/spyaxe-info.asp


thanks Maitre