SpyAxe

?

?

SpyAxe is a new malware program which started making the rounds in December, 2005. According to F-Secure, over 2,500 PCs per hour are being hijacked by this malware. SpyAxe is a reputed anti-spyware program that makes use of a known trojan horse to display annoying popup windows. These alerts warn the user that their computer is infected with spyware. If the user clicks on the popup, a browser window is opened and the program SpyAxe is downloaded from www.spyaxe.com.

Despite SpyAxe.com's slick marketing, please be warned that this is not a legitimate company. SpyAxe is not based out of New Zealand, and in fact the program was created by a group of hackers as a scam.

After SpyAxe is installed, it will conduct scans but will not disable any spyware until the program is purchased. SpyAxe can not be uninstalled from the Windows Add/Remove Programs list.

SpyAxe makes extensive use of false positives, even detecting a registry key that belongs to the operating system. It is installed by the trojan horse, Trojan-Downloader.Win32.Zlob. Other trojans that install this software include ZToolbar and Trojan.Puper.

Update (12/30/2005): I have been informed that SpyAxe is rapidly expanding the number of ways by which it is infecting PCs. As of right now, no tool is guaranteed to remove this product. However, I have had reports that Webroot and Spyware Doctor have been able to detect and remove certain variants of SpyAxe.

Read more about the hunt for the creators of SpyAxe here.

Read about the Hunt for SpyAxe