Follow:

 

Adware:Win32/SpyAxe


Win32/SpyAxe is a program that displays misleading warning messages in order to convince users to purchase a product that removes spyware.


What to do now

Win32/SpyAxe may place an uninstaller entry in "Add or Remove Programs" in Control Panel. If an uninstaller is not available or if you do not want to use the uninstaller that is provided, use Microsoft Windows Defender or another up-to-date scanning and removal tool to detect and remove Win32/SpyAxe and other unwanted software from your computer. For more information, see http://www.microsoft.com/protect/products/computer/default.mspx.

Threat behavior

Win32/SpyAxe is a program that displays misleading warning messages in order to convince users to purchase a product that removes spyware.

Symptoms

System Changes
The following symptoms may indicate the presence of Win32/SpyAxe on an affected machine:
 
  • An uninstaller entry for Win32/SpyAxe-detected application in the "Add or Remove Programs" menu in the Control Panel.
  • A Win32/SpyAxe-detected application entry under the Programs area of the user's Start Menu.
  • A Win32/SpyAxe icon in the system tray, resembling one of the following graphics:

                  
 
  • An application shortcut on the desktop, resembling one of the following graphics:

 
             
 
  • The appearance of a dialogue box resembling the graphic below; the dialogue box warns that the system is infected with spyware and prompts the user to purchase Win32/SpyAxe to remove spyware:

 
 
Below is an example of a similar program known as VirusHeat, performing a 'scan':
 
 
 

Prevention


Alert level: Severe
This entry was first published on: May 19, 2008
This entry was updated on: May 19, 2008

This threat is also detected as:
  • VirusHeat (other)
  • ControVirus (other)