PepiMK
2008-11-08, 15:40
The following instructions have been created to help you to get rid of "SpyAxe" manually.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Categories:
pups
Description:
Nags the user to purchase. Registry keys, an executable program and a library remain in memory and harddisc when unistalled.
Supposed Functionality:
Spyware detection utility that nags the user to purchase.
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "SpyAxe.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Start Menu:
Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0 Website.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.url".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "Uninstall SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\uninst.exe".
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "SpywareAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
Quicklaunch symbols named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "SpywareAxe".
Entries named "SpyAxe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "SpywareAxe".
Products that have a key or property named "SpyAxe".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
A file with an unknown location named "spyaxe_setup.exe".
The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0 Website.lnk".
The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0.lnk".
The file at "<$PROGRAMS>\SpywareAxe\Uninstall SpywareAxe 3.0.lnk".
The file at "<$PROGRAMFILES>\SpywareAxe\signatures.ref".
The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.url".
The file at "<$PROGRAMFILES>\SpywareAxe\uninst.exe".
The file at "<$PROGRAMFILES>\SpywareAxe\Lang\English.ini".
The file at "<$DESKTOP>\SpywareAxe.lnk".
The file at "<$LOCALSETTINGS>\Temp\sa8.exe".
The file at "<$LOCALSETTINGS>\Temp\saB.exe".
The file at "<$STARTMENU>\SpywareAxe 3.0.lnk".
The file at "<$SYSDIR>\wbeconm.dll".
A file with an unknown location named "Wbeconm.exe".
A file with an unknown location named "spyaxe_setup.exe".
A file with an unknown location named "sa_setup.exe".
A file with an unknown location named "sa_setup.exe".
A file with an unknown location named "sa_setup.exe".
The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
The file at "<$SYSDIR>\svchosts.dll".
The file at "<$SYSDIR>\svchosts.dll".
The file at "<$SYSDIR>\svchosts.dll".
A file with an unknown location named "SpyAxe.exe".
A file with an unknown location named "SpyAxe.exe".
The file at "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
The file at "<$PROGRAMFILES>\SpyAxe\DbgHelp.Dll".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMS>\SpywareAxe".
The directory at "<$PROGRAMFILES>\SpywareAxe".
The directory at "<$PROGRAMFILES>\SpywareAxe\Lang".
The directory at "<$PROGRAMFILES>\SpywareAxe\Quarantine".
The directory at "<$PROGRAMFILES>\SpyAxe".
The directory at "<$PROGRAMFILES>\SpyAxe\Quarantine".
The directory at "<$PROGRAMS>\SpyAxe".
Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CURRENT_USER\Software\Classes\CLSID\".
Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{20FB94DC-67D8-4811-B090-7137D0DD8B9C}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{250CB705-B9F5-4C77-A8C0-8D9D436FCFF4}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3BB3DDAF-7867-44B1-90FC-AC425344724D}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{44B2F61F-7081-4B93-AE50-CD568548E4A7}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{47FBD835-E417-48F6-A04D-7B702C5052C5}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{627AEB80-5854-4436-BB57-79E51C7491C1}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{707B19E6-4207-4D3F-B0A8-319DBA2E6B93}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{78AB494D-026F-43A5-8071-E4411FD7859B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{7C987433-CAB4-499A-A0CE-A518F3C54E96}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{9AD637EF-97F0-4F13-AA24-E84AA5C0E1CE}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{B7F4F12C-AA9D-421A-A9A6-CC5FF952A4A4}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{BCFD6185-8C88-45DB-9A5F-3659B05E8BD5}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{C74D1FC2-A047-44FD-B1D1-2E7F193F1762}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{DA8DA181-7B27-475C-B872-1A77751CC10A}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{DEA859D7-ABB8-4239-B454-6731F4891560}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FCF0A3DD-9231-4625-84C6-4810BBE5F54B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "spywareaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry key "SpywareAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
Delete the registry value "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\".
Delete the registry key "{6D42E870-6D15-4C82-8C78-ECD53FF5B6F0}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "{0F68A8AA-A9A8-4711-BE36-AE363EFA6443}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{28420952-C82B-47D9-A042-FA2217D8A082}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3C099C83-8587-4B35-8AF0-FC3A169CE14F}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3FE13F31-E890-4C37-8213-4B5F9A511C26}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{4CAD27DC-1B60-42F4-820E-316FE0A13512}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{54874D12-C0C6-44CC-83FB-2C35202F881B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{54A3200B-D76E-48D1-B35C-D87EAF6D90BD}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{663DFE59-032C-46FB-A09A-FFC2DC074F54}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{69CE4FBC-4861-4206-8211-DD5A9EE79AD3}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{AFA9056F-AA11-4771-AE01-04ECFDE18206}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{B8F2487F-AA6A-4914-9A3F-DB84E6868D66}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{E4645720-E02F-4BB2-8E6D-BE7653DD1BF2}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FA46B160-C9DD-4040-B9D9-CCF5D3DB5438}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FC1F0C2C-8117-427D-816C-215B68524F74}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FD1EEE96-8DC7-478D-BE3B-7D06AC67FB66}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FD8E5ED7-0091-416F-A55B-1D072D58A24F}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "SpyAxe.EXE" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry key "{06506B3A-857D-431f-BE0B-038B1EC386B3}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0BFF94F7-9748-43d1-BAC4-D963351B63E7}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0C580891-CA9D-4619-BDC9-85378EB65931}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{53525A6C-3774-4b47-B317-BC7DFE4FC7ED}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{5DEB9A24-19E0-49e6-A6B2-110BC3E1062A}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{5E1ACE2A-8638-4775-8AA9-5C187AD40A82}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{629C4FE9-B627-4905-AF5B-AD652BB1B5C5}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{659F78EA-6FF2-40f8-8EA3-06F7418A209E}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7616A7F7-DF99-432f-870D-4AFEA0D079F4}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7EB22F36-2CCD-4003-89EE-6CF40EBC4282}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{A0D06AA3-499B-4156-9FFD-0BE236F0D4E5}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{B6610F1D-DA77-42c4-8300-721D9DA9D70B}" at "HKEY_CLASSES_ROOT\CLSID\".
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection.1", plus associated values.
Delete the registry key "{2BB3BCBF-411A-4C67-8E69-F4BB301DC333}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "spyaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry key "SpyAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
If SpyAxe uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
If you have any further questions, please ask in our forum (http://forums.spybot.info/).
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Categories:
pups
Description:
Nags the user to purchase. Registry keys, an executable program and a library remain in memory and harddisc when unistalled.
Supposed Functionality:
Spyware detection utility that nags the user to purchase.
Desktop:
Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Shortcuts named "SpyAxe.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Start Menu:
Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0 Website.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.url".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Items named "Uninstall SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\uninst.exe".
Quicklaunch area:
Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.
Quicklaunch symbols named "SpywareAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
Quicklaunch symbols named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
Autorun:
Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd), RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) or msconfig.exe to remove the following autorun entries.
Entries named "SpywareAxe".
Entries named "SpyAxe".
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "SpywareAxe".
Products that have a key or property named "SpyAxe".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
A file with an unknown location named "spyaxe_setup.exe".
The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0 Website.lnk".
The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0.lnk".
The file at "<$PROGRAMS>\SpywareAxe\Uninstall SpywareAxe 3.0.lnk".
The file at "<$PROGRAMFILES>\SpywareAxe\signatures.ref".
The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.url".
The file at "<$PROGRAMFILES>\SpywareAxe\uninst.exe".
The file at "<$PROGRAMFILES>\SpywareAxe\Lang\English.ini".
The file at "<$DESKTOP>\SpywareAxe.lnk".
The file at "<$LOCALSETTINGS>\Temp\sa8.exe".
The file at "<$LOCALSETTINGS>\Temp\saB.exe".
The file at "<$STARTMENU>\SpywareAxe 3.0.lnk".
The file at "<$SYSDIR>\wbeconm.dll".
A file with an unknown location named "Wbeconm.exe".
A file with an unknown location named "spyaxe_setup.exe".
A file with an unknown location named "sa_setup.exe".
A file with an unknown location named "sa_setup.exe".
A file with an unknown location named "sa_setup.exe".
The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
The file at "<$SYSDIR>\svchosts.dll".
The file at "<$SYSDIR>\svchosts.dll".
The file at "<$SYSDIR>\svchosts.dll".
A file with an unknown location named "SpyAxe.exe".
A file with an unknown location named "SpyAxe.exe".
The file at "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
The file at "<$PROGRAMFILES>\SpyAxe\DbgHelp.Dll".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$PROGRAMS>\SpywareAxe".
The directory at "<$PROGRAMFILES>\SpywareAxe".
The directory at "<$PROGRAMFILES>\SpywareAxe\Lang".
The directory at "<$PROGRAMFILES>\SpywareAxe\Quarantine".
The directory at "<$PROGRAMFILES>\SpyAxe".
The directory at "<$PROGRAMFILES>\SpyAxe\Quarantine".
The directory at "<$PROGRAMS>\SpyAxe".
Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CURRENT_USER\Software\Classes\CLSID\".
Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{20FB94DC-67D8-4811-B090-7137D0DD8B9C}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{250CB705-B9F5-4C77-A8C0-8D9D436FCFF4}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3BB3DDAF-7867-44B1-90FC-AC425344724D}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{44B2F61F-7081-4B93-AE50-CD568548E4A7}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{47FBD835-E417-48F6-A04D-7B702C5052C5}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{627AEB80-5854-4436-BB57-79E51C7491C1}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{707B19E6-4207-4D3F-B0A8-319DBA2E6B93}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{78AB494D-026F-43A5-8071-E4411FD7859B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{7C987433-CAB4-499A-A0CE-A518F3C54E96}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{9AD637EF-97F0-4F13-AA24-E84AA5C0E1CE}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{B7F4F12C-AA9D-421A-A9A6-CC5FF952A4A4}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{BCFD6185-8C88-45DB-9A5F-3659B05E8BD5}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{C74D1FC2-A047-44FD-B1D1-2E7F193F1762}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{DA8DA181-7B27-475C-B872-1A77751CC10A}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{DEA859D7-ABB8-4239-B454-6731F4891560}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FCF0A3DD-9231-4625-84C6-4810BBE5F54B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "spywareaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry key "SpywareAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
Delete the registry value "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\".
Delete the registry key "{6D42E870-6D15-4C82-8C78-ECD53FF5B6F0}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "{0F68A8AA-A9A8-4711-BE36-AE363EFA6443}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{28420952-C82B-47D9-A042-FA2217D8A082}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3C099C83-8587-4B35-8AF0-FC3A169CE14F}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{3FE13F31-E890-4C37-8213-4B5F9A511C26}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{4CAD27DC-1B60-42F4-820E-316FE0A13512}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{54874D12-C0C6-44CC-83FB-2C35202F881B}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{54A3200B-D76E-48D1-B35C-D87EAF6D90BD}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{663DFE59-032C-46FB-A09A-FFC2DC074F54}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{69CE4FBC-4861-4206-8211-DD5A9EE79AD3}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{AFA9056F-AA11-4771-AE01-04ECFDE18206}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{B8F2487F-AA6A-4914-9A3F-DB84E6868D66}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{E4645720-E02F-4BB2-8E6D-BE7653DD1BF2}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FA46B160-C9DD-4040-B9D9-CCF5D3DB5438}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FC1F0C2C-8117-427D-816C-215B68524F74}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FD1EEE96-8DC7-478D-BE3B-7D06AC67FB66}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{FD8E5ED7-0091-416F-A55B-1D072D58A24F}" at "HKEY_CLASSES_ROOT\Interface\".
Delete the registry key "{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "SpyAxe.EXE" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry key "{06506B3A-857D-431f-BE0B-038B1EC386B3}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0BFF94F7-9748-43d1-BAC4-D963351B63E7}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0C580891-CA9D-4619-BDC9-85378EB65931}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{53525A6C-3774-4b47-B317-BC7DFE4FC7ED}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{5DEB9A24-19E0-49e6-A6B2-110BC3E1062A}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{5E1ACE2A-8638-4775-8AA9-5C187AD40A82}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{629C4FE9-B627-4905-AF5B-AD652BB1B5C5}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{659F78EA-6FF2-40f8-8EA3-06F7418A209E}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7616A7F7-DF99-432f-870D-4AFEA0D079F4}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{7EB22F36-2CCD-4003-89EE-6CF40EBC4282}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{A0D06AA3-499B-4156-9FFD-0BE236F0D4E5}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{B6610F1D-DA77-42c4-8300-721D9DA9D70B}" at "HKEY_CLASSES_ROOT\CLSID\".
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem.1", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection.1", plus associated values.
Delete the registry key "{2BB3BCBF-411A-4C67-8E69-F4BB301DC333}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "spyaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
Delete the registry key "SpyAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
If SpyAxe uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
If you have any further questions, please ask in our forum (http://forums.spybot.info/).