A new type of virus

[Bob Woods]

I was going to write a long story but when I went looking for
references I found this web site, I still don't have mine fixed. I did
fall sucker to it and buy SpywareStrike as it was the only program that
would clean up my system. I feel screwed and my system is very likely
still infected. If you see the message don't click on it, I don't know
what to do, perhaps pull the power plug? Bob Woods

SpywareStrike is a trojan that displays an icon in the system tray.
This icons shows a message, which says that the compromised computer is
infected with dangerous spyware parasites and asks the user to download
and install an anti-malware program, which actually is SpywareStrike,
corrupt illegaly distributed spyware remover. Once the user clicks on
such message, the trojan opens the official web site of SpywareStrike.
It may also try to download the application. The trojan is able to
change the Internet Explorer default home page and redirect the web
browser to malicious web sites. SpywareStrike automatically runs on
every Windows startup.

http://www.2-spyware.com/remove-spywarestrike.html?gclid=COGYpNS6uYICFT40OAodglzjFA

 

[Pete C.]

A nd you expect us to open a link that came from your infected computer... I think not Mr. Woods.

But good luck in cleaning it up.

Sometimes it's a good thing to have to start from scratch, and reformat that cluttered hard drive. You'd be amazed at how much faster everything works.

 

[Bob Woods]

Do a search for spywarestrike spyaxe spyware doc if you feel safer.

Heres the guy that owns the web sites.

Domain name: Spyaxe.com
Registrant:
SunShine Ltd
David Taylor ([email protected])
187th Ave, 5
King County
Seattle
Washington,98101
US
Tel. +206.9543154

Creation Date: 31-Aug-2005
Expiration Date: 31-Aug-2007


Domain Name: SPYWARESTRIKE.COM

Registrant:
Keramitsu LLC
David Alan Taylor ([email protected])
321th Melburn Street
Seattle
Washington,98107
US
Tel. +207.9545521

Creation Date: 20-Dec-2005
Expiration Date: 20-Dec-200

 

[Bob Woods]

I used http://www.ewido.net/en/download/
to clean that crap off my system.

Further reseach has revealed that SpywareStrike is a valid anti-spyware program, but it has fallen into the hands of agessive marketing scumbags. MLM has struck again. A web site known as 2-spyware.com has the history of at begining as sheriffware, axeware, axware and a few other terms. Originally it was rated as a powerful antispyware program, but was turned into pestware in an agressive marketing scheme that included browser hijacking. There is a program that will clean your system called "Ewido anti malware", 2-spyware.com has manual instructions for removing it from your system. The SpywareStrike attack begin Jan 5 2006 and is far from over.

 

[Not the Autorx Frank]

Steve Gibson is by far one of the most knowledgeable Security experts alive. Look up podcasts "Security Now" on Itunes or visit his site http://grc.com/.

Also Leo Laporte is a great resource at "Radio Leo" podcast or his website http://www.leoville.com/

The key is prevention because there is no program that can rid it all.

 

[Not the Autorx Frank]

http://www.grc.com/discussions.htm

security forums. this is an insane wealth of information....

 

[Pablo]

I don't get the MLM jackatt wisecrack.

This has nothing to do with legitimate MLM.

 

[Not the Autorx Frank]

Pablo, agreed.

First order of business for christs sake is to stop using IE. Windows 101 here.. jeeeze

 

[Bob Woods]

If you look at the spywarestrike.com web site they offer a MLM program, placing a link will get you money, paid twice a month.


I use http://grc.com/ to check the security of my firewalls, I'm steath since I run two firewalls. Some how this got by firewalls, AVG antivirus, popup blockers, and System Mechanic spyblocker. I now have Ewido anti malware, its the only program that found spywarestrike and spyaxe and about 60 others. and it was free for 14 days and 30 bucks after that.

 

[Not the Autorx Frank]

good argument for a mac. sorry couldn't resist.

 

[ToyotaNSaturn]

SpywareAxe sounds awfully familar to the SpywareStrike. Just ran into this da** spyware this past week at work. Counterspy, Adaware and PestPatrol couldn't fully remove it from a guy's system.

After Googling for a while, I found the solution at Help2Go.com. BITOG isn't allowing the link to the web page due to HTML linking limitations.

The bottom line is that you need the smitRemover. Click here for the download: http://noahdfear.geekstogo.com/click counter/click.php?id=1


Save it to a folder and extract it. Close everything, including all Explorer windows, run that .bat file. It worked for a computer that I tried it on this past week. Follow the prompts in the .bat file. This thing really works!

Good luck...

Then go here: www.getfirefox.com

 

[Bob Woods]

http://www.ewido.net/en/download/

Solved the problem and its free for 14 days, 30 bucks after that. It was also known as Spysheriff and spyaxe and a few other names, they just rename it and continue on.

 

[Pablo]

Bob - please use some logic. Blaming MLM for spyware is like blaming free enterprise for illegal drugs. Sheesh, no wonder you are being infested.

 

[Bob Woods]

Pablo, Sorry I have gotten you all riled up, but I personally will not buy any product no matter how great if it is marketed via MLM. I use Mobil One and not Amzoil because of that, Amway made/sells some great products but I refuse to buy them too. This SpywareStrike is a good product that has been converted to pestware by a agressive MLM marketing scheme.

 

[Pablo]

"MLM marketing" DID NOT convert this program to pestware. You are very confused. For a clue: A perverse human being creates these type of nasty bugs. And it seems they need no special way of distribution.....

 

[Bob Woods]

Your right MLM did not create the moster, but the jerk that created the agressive marketing scheme that included browser hijacking, also offers a MLM marketing scheme along with it.

 

[Pablo]

I suppose he'll sell direct, or give it as a gift too, so be very careful.

I'm sure if MLM was illegal this would have never happened.

 

[9c1]

Thank you so much Bob for posting this information. I just spent three evenings getting rid of that cra$. Without your posted information I likely would have spent much longer at it. In my case it got past two fire walls. Three anti-virus, anti-adware programs at best only detected it, but wouldn't remove it. Ewido did the trick. Thanks again.
Terry

 

[Bob Woods]

Your Welcome Terry, That's the reason I posted the info. This new malware avoids antiviral detection and until the antispyware has a difinition loaded in its data base its useless. My suggestion is when you see the bubble for the first time, don't click on the X to close it, and don't click on the box marked "close", , clicking on either just starts the download that only takes few seconds. use Alt/F4

 

[Bob Woods]

This morning AVG virus protection found Trojan Horse Downloader; Zlob.FD Its a trojan reloader .dll file that loads spyaxe/spywarestrike.