The following instructions have been created to help you to get rid of "SpyAxe" manually.
If this guide was helpful to you, please consider donating towards this site.

Categories:
  • pups


Description:
Nags the user to purchase. Registry keys, an executable program and a library remain in memory and harddisc when unistalled.
Supposed Functionality:
Spyware detection utility that nags the user to purchase.
Desktop:

Please remove the following files from your desktop.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

  • Shortcuts named "SpyAxe.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".



Start Menu:

Please remove the following items from your start menu.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

  • Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
  • Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
  • Items named "SpyAxe 3.0 Website.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.url".
  • Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
  • Items named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
  • Items named "Uninstall SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\uninst.exe".



Quicklaunch area:

Please remove the following items from your start quick launch area text to the "Start" button in the taskbar at the bottom.
To check where they are pointing to, right-click them and choose "Properties" from the context menu appearing.

  • Quicklaunch symbols named "SpywareAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
  • Quicklaunch symbols named "SpyAxe 3.0.lnk" and pointing to "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".



Autorun:

Please use Spybot-S&D, RunAlyzer or msconfig.exe to remove the following autorun entries.

  • Entries named "SpywareAxe".
  • Entries named "SpyAxe".



Installed Software List:

You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D or RunAlyzer to locate and get rid of these entries.

  • Products that have a key or property named "SpywareAxe".
  • Products that have a key or property named "SpyAxe".



Files:

Please use Windows Explorer or another file manager of your choice to locate and delete these files.

  • A file with an unknown location named "spyaxe_setup.exe".
  • The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0 Website.lnk".
  • The file at "<$PROGRAMS>\SpywareAxe\SpywareAxe 3.0.lnk".
  • The file at "<$PROGRAMS>\SpywareAxe\Uninstall SpywareAxe 3.0.lnk".
  • The file at "<$PROGRAMFILES>\SpywareAxe\signatures.ref".
  • The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.exe".
  • The file at "<$PROGRAMFILES>\SpywareAxe\SpywareAxe.url".
  • The file at "<$PROGRAMFILES>\SpywareAxe\uninst.exe".
  • The file at "<$PROGRAMFILES>\SpywareAxe\Lang\English.ini".
  • The file at "<$DESKTOP>\SpywareAxe.lnk".
  • The file at "<$LOCALSETTINGS>\Temp\sa8.exe".
  • The file at "<$LOCALSETTINGS>\Temp\saB.exe".
  • The file at "<$STARTMENU>\SpywareAxe 3.0.lnk".
  • The file at "<$SYSDIR>\wbeconm.dll".
  • A file with an unknown location named "Wbeconm.exe".
  • A file with an unknown location named "spyaxe_setup.exe".
  • A file with an unknown location named "sa_setup.exe".
  • A file with an unknown location named "sa_setup.exe".
  • A file with an unknown location named "sa_setup.exe".
  • The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
  • The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
  • The file at "<$SYSDIR>\svchosts.dll".
  • The file at "<$SYSDIR>\svchosts.dll".
  • The file at "<$SYSDIR>\svchosts.dll".
  • A file with an unknown location named "SpyAxe.exe".
  • A file with an unknown location named "SpyAxe.exe".
  • The file at "<$PROGRAMFILES>\SpyAxe\SpyAxe.exe".
  • The file at "<$PROGRAMFILES>\SpyAxe\uninst.exe".
  • The file at "<$PROGRAMFILES>\SpyAxe\DbgHelp.Dll".
  • The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".
  • The file at "<$LOCALSETTINGS>\Temp\SALanguage.ini".


Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!

Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D to remove them.

Folders:

Please use Windows Explorer or another file manager of your choice to locate and delete these folders.

  • The directory at "<$PROGRAMS>\SpywareAxe".
  • The directory at "<$PROGRAMFILES>\SpywareAxe".
  • The directory at "<$PROGRAMFILES>\SpywareAxe\Lang".
  • The directory at "<$PROGRAMFILES>\SpywareAxe\Quarantine".
  • The directory at "<$PROGRAMFILES>\SpyAxe".
  • The directory at "<$PROGRAMFILES>\SpyAxe\Quarantine".
  • The directory at "<$PROGRAMS>\SpyAxe".


Make sure you set your file manager to display hidden and system files. If SpyAxe uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!

Registry:

You can use regedit.exe (included in Windows) to locate and delete these registry entries.

  • Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CURRENT_USER\Software\Classes\CLSID\".
  • Delete the registry key "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{20FB94DC-67D8-4811-B090-7137D0DD8B9C}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{250CB705-B9F5-4C77-A8C0-8D9D436FCFF4}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{3BB3DDAF-7867-44B1-90FC-AC425344724D}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{44B2F61F-7081-4B93-AE50-CD568548E4A7}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{47FBD835-E417-48F6-A04D-7B702C5052C5}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{627AEB80-5854-4436-BB57-79E51C7491C1}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{707B19E6-4207-4D3F-B0A8-319DBA2E6B93}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{78AB494D-026F-43A5-8071-E4411FD7859B}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{7C987433-CAB4-499A-A0CE-A518F3C54E96}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{9AD637EF-97F0-4F13-AA24-E84AA5C0E1CE}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{B7F4F12C-AA9D-421A-A9A6-CC5FF952A4A4}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{BCFD6185-8C88-45DB-9A5F-3659B05E8BD5}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{C74D1FC2-A047-44FD-B1D1-2E7F193F1762}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{DA8DA181-7B27-475C-B872-1A77751CC10A}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{DEA859D7-ABB8-4239-B454-6731F4891560}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{FCF0A3DD-9231-4625-84C6-4810BBE5F54B}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "spywareaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
  • Delete the registry key "SpywareAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
  • Delete the registry value "{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\".
  • Delete the registry key "{6D42E870-6D15-4C82-8C78-ECD53FF5B6F0}" at "HKEY_CLASSES_ROOT\TypeLib\".
  • Delete the registry key "{0F68A8AA-A9A8-4711-BE36-AE363EFA6443}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{28420952-C82B-47D9-A042-FA2217D8A082}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{3C099C83-8587-4B35-8AF0-FC3A169CE14F}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{3FE13F31-E890-4C37-8213-4B5F9A511C26}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{4CAD27DC-1B60-42F4-820E-316FE0A13512}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{54874D12-C0C6-44CC-83FB-2C35202F881B}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{54A3200B-D76E-48D1-B35C-D87EAF6D90BD}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{663DFE59-032C-46FB-A09A-FFC2DC074F54}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{69CE4FBC-4861-4206-8211-DD5A9EE79AD3}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{AFA9056F-AA11-4771-AE01-04ECFDE18206}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{B8F2487F-AA6A-4914-9A3F-DB84E6868D66}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{E4645720-E02F-4BB2-8E6D-BE7653DD1BF2}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{FA46B160-C9DD-4040-B9D9-CCF5D3DB5438}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{FC1F0C2C-8117-427D-816C-215B68524F74}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{FD1EEE96-8DC7-478D-BE3B-7D06AC67FB66}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{FD8E5ED7-0091-416F-A55B-1D072D58A24F}" at "HKEY_CLASSES_ROOT\Interface\".
  • Delete the registry key "{A2D9D3F0-8C2A-2A1D-A376-1BECFB10AB72}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "SpyAxe.EXE" at "HKEY_CLASSES_ROOT\AppID\".
  • Delete the registry key "{06506B3A-857D-431f-BE0B-038B1EC386B3}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{0BFF94F7-9748-43d1-BAC4-D963351B63E7}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{0C580891-CA9D-4619-BDC9-85378EB65931}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{53525A6C-3774-4b47-B317-BC7DFE4FC7ED}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{5DEB9A24-19E0-49e6-A6B2-110BC3E1062A}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{5E1ACE2A-8638-4775-8AA9-5C187AD40A82}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{629C4FE9-B627-4905-AF5B-AD652BB1B5C5}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{659F78EA-6FF2-40f8-8EA3-06F7418A209E}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{7616A7F7-DF99-432f-870D-4AFEA0D079F4}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{7EB22F36-2CCD-4003-89EE-6CF40EBC4282}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{A0D06AA3-499B-4156-9FFD-0BE236F0D4E5}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{B6610F1D-DA77-42c4-8300-721D9DA9D70B}" at "HKEY_CLASSES_ROOT\CLSID\".
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Backup.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.EngineListener.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Log.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.LogRecord.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Paths.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Quarantine.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.RunAs.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.Scanner.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.SearchItem.1", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection", plus associated values.
  • A key in HKEY_CLASSES_ROOT\ named "SpyAxe.ThreatCollection.1", plus associated values.
  • Delete the registry key "{2BB3BCBF-411A-4C67-8E69-F4BB301DC333}" at "HKEY_CLASSES_ROOT\TypeLib\".
  • Delete the registry key "spyaxe.exe" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\".
  • Delete the registry key "SpyAxe" at "HKEY_LOCAL_MACHINE\SOFTWARE\".


If SpyAxe uses rootkit technologies, use our RegAlyzer, RootAlyzer or our Total Commander anti-rootkit plugins.


If you have any further questions, please ask in our forum.