Spyaxe & Spyware Doctor destroying it. - Tilted Forum Project Discussion Community

pan6467 · 12-03-2005, 03:57 PM

I was surfing and came across this doozy of a bad bug. It goes nuts with your system. you keep getting a warning from your microsoft bullseye (if you have MS antispyware) telling you that you've been infected. Every time you click it you go to "spyaxe's" website.

From what I have read on sites after being infected and getting rid of it, Spyaxe is a fast growing malware that is truly nasty. I did a search to see if anyone else has posted anything about it, but noone had soooooo....

The infected balloon just keeps coming up.

Norton goes crazy, NOTHING I had seemed to even touch it.

This thing blocks websites (switching browsers tho worked), it truly seemed to take over.

What I did was went in removed it through the start. Did a quick search found http://www.thex.com/rd/2005/11/26/firefox-spyaxe and went there. He tells you how to get rid of it, but Hell I don't even know how to get into safe mode. (His way listed at end of post, for those of you who know what to do and how.)

So I searched again, found Spyware Doctor did the scan, it found 127 nasties including Spyaxe. Now it cost $29.95 but had great reviews from what I could tell. I bought it..... wham bam everything including spyaxe is gone.

Anyone know about either? Is Spyware Doctor as good as it seems or am I a sucker for buying it?

Here's the site's way to get rid of Spyaxe for you tech geeks who can know what you're doing and can just go in and bing bam boom take care of the nasty.

Quote:

FireFox - SpyAxe
I was just browsing happily away, secure in the knowledge that FireFox is a much better browser than any other. It generally blocks pop-ups and so on, is more secure than any other, but ‘lo what happens?

My FireFox browser shuts itself down without any warning. Then I look on my desktop, and I see a program called “SpyAxe” had been installed!! Without my say-so no less! Looking on the toolbar, I see two new icons next to my sound controls, network icon, panda anti-virus. The strange thing is, one is exactly like the Windows Update icon. It’s flashing, telling me spyware has been detected.

So I think to myself, how could this happen? Something fishy here. I run Panda, and its found two virii so far. I’ll run Spybot next. How could this happen when I’m running Firefox? I thought it asks if you download something, and certainly isn’t supposed to install things without asking!

Update: I saw a thread over at Spyware Warrior, talking about SpyAxe. One of the commenters said I didn’t post what I was doing so here is the update. I use FireFox for everything, browing blogs, my own coding (nothing nefarious, mostly blog coding, site coding). At the time I think I had Technorati, some computer security sites open (I was writing articles on Networks & Security), and some blogs that I clicked on from BOTD. Now it could be that one of those was “set up” to give out versions of SpyAxe, not sure. Also, I have no FireFox extensions, no 2nd party additions - I use a naked FireFox.

Anyway, here is the process I took to get rid of the SpyAxe *cursing noises*, so others can do it for themselves.

Download HiJackThis;
Reboot the computer into safe mode;
When in Safe Mode, remove SpyAxe.
Run HiJackThis, my “infection” was HomepageBHO, delete it;
Run regedit and find this key:
HKEY_LOCAL_MACHINE\
SOFTWARE\
Microsoft\
Windows\
CurrentVersion\
policies\
Explorer\
run

You’re looking for the mssearchnet and nvctrl entries - delete them outright (right click, delete).

Reboot

That’s what fixed it for me. If this works for you, add a comment to the thread. If not, say so, we can work on it some more.

I hope this helps all who need it......

But I also hope to see some posts that give honest reviews of Spyware Doctor, also.

phukraut · 12-03-2005, 05:03 PM

For future reference: you press F8 during the bootup sequence to get several options, then from those you can choose to boot into safe mode.

pan6467 · 12-03-2005, 05:08 PM

Thank you Phukraut. Hope my info has helped you, I will write yours down so I'll know what to do.

Lucifer · 12-04-2005, 11:37 AM

I just had this happen to me too on Friday night. Clicked on a picture, and Blam! two new icons on my desktop, and the browser hijacked over to the spyaxe website. I kept getting a pop-up box on re-boots telling me to uninstall norton antivirus and re-install, and I couldn't get rid of the icons. I used Norton's Go-back to restore my system to an earlier time, and everything seems to be ok now. But I'll follow your tips to make sure everything is gone

phukraut · 12-04-2005, 03:41 PM

I'd also recommend getting a program called SpywareBlaster. You run it, say once a week, and it gives you kind of flu shot against nasties. It writes dummy entries into your registry so that when a malware wants to do something to it, like install itself as a BHO as the above example, it gets sterilized. The nice thing about it is that you don't run it constantly. You run, innoculate, and shut down the program.

MontanaXVI · 12-04-2005, 04:42 PM

I would say that the ms antispyware is supposed to block such a thing from happening, kind of like the pay version of ad aware it has the real time protections to prevent things from taking over like this. Are all your definition files up to date and all the protections that you have enabled?

pan6467 · 12-04-2005, 06:54 PM

Quote:

Originally Posted by MontanaXVI

I would say that the ms antispyware is supposed to block such a thing from happening, kind of like the pay version of ad aware it has the real time protections to prevent things from taking over like this. Are all your definition files up to date and all the protections that you have enabled?

Mine were. I check for updates at least 2-3 times a week on MSN Beta and this thing just took over.

The way it acted (and grant you I am computer illetrate in many ways), it seemed to me that it targeted my MSN AntiSpyware as it changed the little bullseye icon, it changed the desktop icon and when I would hit what was my MSN it would take me to their site.

Perhaps there is a flaw or backdoor in the MSN anti-spyware that Spyaxe focuses on and can attach itself to.

All I know is that Spyware Doctor took care of my problem and whatever else was in there because my computer is faster now that I installed it and had it do its thing.

MontanaXVI · 12-04-2005, 10:51 PM

this is going to sound really bad, but the curious side of me kinda wants to see how badass this Spyaxe is for myself and if my current security checks are enough.

texxasco · 12-04-2005, 10:59 PM

Do you recall what website you contacted this bug from? I sort of feel like Montana in that I'd like to see if I am well protected. I am currently running MS Anti-Spyware, Spybot S&D, and Pest Patrol...in addiction to my firewall.

...Glad to got rid of your problem though...sounded like a real pain in the ass.

MontanaXVI · 12-04-2005, 11:48 PM

I got symantec client security installed here, which includes symantec av (better than norton not the memory hog norton is, even though both made by same company) symantec personal firewall, along with the usual spybot and ad aware.

I personally am not a fan of the MS anti spyware as it kept crashing on me, since it is just a beta give it time or wait on a newer release and I might be happier.

alpha phi · 12-05-2005, 12:21 AM

I use the spyware warrior web site to verify a good anti spyware product.
Spyware Doctor is on their trusted list:
http://www.spywarewarrior.com/rogue_...tm#trustworthy

the rouge anti spyware programs outnumber the good atleast 50 to 1:
http://www.spywarewarrior.com/rogue_...e.htm#products

my personal setup is:
Ad aware SE free version
Zone alarm firewall
Norton anti virus
Proxomitron../proxy/pop up stopper/java filter and more
a good hosts file
frequent updates of all above + windows updates
No problems in several years......Knock on wood

Lucifer · 12-05-2005, 04:26 AM

Quote:

Originally Posted by MontanaXVI

this is going to sound really bad, but the curious side of me kinda wants to see how badass this Spyaxe is for myself and if my current security checks are enough.

okay, don't say we didn't warn you. better have a ghost image of your drive before you go out searching. I don't remember exactly where I was when I got it, but I'd wager that if you cruised around some links from the "Links" Forum, you'd pick it up before long

Lucifer · 12-05-2005, 04:28 AM

Btw, I use Sunbelt's Counterspy, Spybot S&D, Ad Aware, and I have two hardware firewalls and a software firewall, Norton Systemworks; and this bugger still nailed me before I could blink.

portwineboy · 12-05-2005, 05:51 AM

There is a sticky "tons of popups, homepage changed?" that has the aggregate info on spyware and recommended programs. Check it out.

I would never pay for a spyware removal program because as someone else said, many of them are actually more malware.

Lucifer · 12-05-2005, 06:11 AM

I paid for Counterspy, and I'm glad I did, but I would never buy from a site that had hijacked my browser in order to sell it's product.

pan6467 · 12-05-2005, 08:13 AM

Quote:

Originally Posted by portwineboy

There is a sticky "tons of popups, homepage changed?" that has the aggregate info on spyware and recommended programs. Check it out.

I would never pay for a spyware removal program because as someone else said, many of them are actually more malware.

I have Adware, Norton systemworks, MSN AntiSpyware Beta, S&D, Blaster and none of them helped me.

Spyware Doctor takes awhile to go through the system but it has done wonders for me. For peace of mind and to save my computer it is well worth the $29.95, even if my budget is tight, it'll save me from more expensive problems..... well at least I'm hoping it does.

Glory's Sun · 12-05-2005, 08:20 AM

I paid for Spy Sweeper and wouldn't recommend anything else. It's never let me down.

also here's a fix for the spyaxe stuff

http://noahdfear.geekstogo.com/click...click.php?id=8

I haven't used it but it's distributed by the geekstogo guys who seem to do pretty well with this sort of thing

12-03-2005, 05:08 PM	#3 (permalink)
pan6467 Lennonite Priest Location: Mansfield, Ohio USA	Thank you Phukraut. Hope my info has helped you, I will write yours down so I'll know what to do. __________________ I just love people who use the excuse "I use/do this because I LOVE the feeling/joy/happiness it brings me" and expect you to be ok with that as you watch them destroy their life blindly following. My response is, "I like to put forks in an eletrical socket, just LOVE that feeling, can't ever get enough of it, so will you let me put this copper fork in that electric socket?"

12-04-2005, 11:37 AM	#4 (permalink)
Lucifer Husband of Seamaiden Location: Nova Scotia	I just had this happen to me too on Friday night. Clicked on a picture, and Blam! two new icons on my desktop, and the browser hijacked over to the spyaxe website. I kept getting a pop-up box on re-boots telling me to uninstall norton antivirus and re-install, and I couldn't get rid of the icons. I used Norton's Go-back to restore my system to an earlier time, and everything seems to be ok now. But I'll follow your tips to make sure everything is gone __________________ I am a brother to dragons, and a companion to owls. - Job 30:29 1123, 6536, 5321

12-04-2005, 04:42 PM	#6 (permalink)
MontanaXVI Junkie Location: Go A's!!!!	I would say that the ms antispyware is supposed to block such a thing from happening, kind of like the pay version of ad aware it has the real time protections to prevent things from taking over like this. Are all your definition files up to date and all the protections that you have enabled? __________________ Spank you very much

12-04-2005, 10:51 PM	#8 (permalink)
MontanaXVI Junkie Location: Go A's!!!!	this is going to sound really bad, but the curious side of me kinda wants to see how badass this Spyaxe is for myself and if my current security checks are enough. __________________ Spank you very much

12-04-2005, 10:59 PM	#9 (permalink)
texxasco Insane Location: Somewhere in East Texas	Do you recall what website you contacted this bug from? I sort of feel like Montana in that I'd like to see if I am well protected. I am currently running MS Anti-Spyware, Spybot S&D, and Pest Patrol...in addiction to my firewall. ...Glad to got rid of your problem though...sounded like a real pain in the ass. __________________ ...A Bad Day of Fishing is Better Than a Great Day at Work!

12-03-2005, 05:03 PM	#2 (permalink)
phukraut Addict	For future reference: you press F8 during the bootup sequence to get several options, then from those you can choose to boot into safe mode.

12-04-2005, 03:41 PM	#5 (permalink)
phukraut Addict	I'd also recommend getting a program called SpywareBlaster. You run it, say once a week, and it gives you kind of flu shot against nasties. It writes dummy entries into your registry so that when a malware wants to do something to it, like install itself as a BHO as the above example, it gets sterilized. The nice thing about it is that you don't run it constantly. You run, innoculate, and shut down the program.

12-04-2005, 11:48 PM	#10 (permalink)
MontanaXVI Junkie Location: Go A's!!!!	I got symantec client security installed here, which includes symantec av (better than norton not the memory hog norton is, even though both made by same company) symantec personal firewall, along with the usual spybot and ad aware. I personally am not a fan of the MS anti spyware as it kept crashing on me, since it is just a beta give it time or wait on a newer release and I might be happier. __________________ Spank you very much

12-05-2005, 12:21 AM	#11 (permalink)
alpha phi seeker Location: home	I use the spyware warrior web site to verify a good anti spyware product. Spyware Doctor is on their trusted list: http://www.spywarewarrior.com/rogue_...tm#trustworthy the rouge anti spyware programs outnumber the good atleast 50 to 1: http://www.spywarewarrior.com/rogue_...e.htm#products my personal setup is: Ad aware SE free version Zone alarm firewall Norton anti virus Proxomitron../proxy/pop up stopper/java filter and more a good hosts file frequent updates of all above + windows updates No problems in several years......Knock on wood __________________ All ideas in this communication are sole property of the voices in my head. (C) 2005, 2006, 2007, 2008, 2009 "The Voices" (TM). All rights reserved.

12-05-2005, 04:28 AM	#13 (permalink)
Lucifer Husband of Seamaiden Location: Nova Scotia	Btw, I use Sunbelt's Counterspy, Spybot S&D, Ad Aware, and I have two hardware firewalls and a software firewall, Norton Systemworks; and this bugger still nailed me before I could blink. __________________ I am a brother to dragons, and a companion to owls. - Job 30:29 1123, 6536, 5321

12-05-2005, 05:51 AM	#14 (permalink)
portwineboy Master of No Domains Location: WEEhawken, New Joisey	There is a sticky "tons of popups, homepage changed?" that has the aggregate info on spyware and recommended programs. Check it out. I would never pay for a spyware removal program because as someone else said, many of them are actually more malware. __________________ If you can read this, thank a teacher. If you can read this in English, thank a veteran.

12-05-2005, 06:11 AM	#15 (permalink)
Lucifer Husband of Seamaiden Location: Nova Scotia	I paid for Counterspy, and I'm glad I did, but I would never buy from a site that had hijacked my browser in order to sell it's product. __________________ I am a brother to dragons, and a companion to owls. - Job 30:29 1123, 6536, 5321

12-05-2005, 08:20 AM	#17 (permalink)
Glory's Sun Registered User	I paid for Spy Sweeper and wouldn't recommend anything else. It's never let me down. also here's a fix for the spyaxe stuff http://noahdfear.geekstogo.com/click...click.php?id=8 I haven't used it but it's distributed by the geekstogo guys who seem to do pretty well with this sort of thing Last edited by Glory's Sun; 12-05-2005 at 08:23 AM..