# Rick HELP!!! Spy Axe

**URL:** <https://forums.speedlife.net/t/rick-help-spy-axe/5104>\
**Category:** NYSpeed Off Topic\
**Created:** [November 29, 2005, 3:27pm UTC](https://forums.speedlife.net/t/rick-help-spy-axe/5104 "2005-11-29T15:27:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MHill](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MHill](https://forums.speedlife.net/u/MHill)\
**Post date:** [November 29, 2005, 3:27pm UTC](https://forums.speedlife.net/t/rick-help-spy-axe/5104/1 "2005-11-29T15:27:45Z")

</div>

Contracted Spy axe,

Ran Spy bot S&D and adaware SE in safe mode about to run CCleaner

Hasnt seemed to get rid of it yet

help

---

<div class="post-metadata">

**Author:** ![Ovrwrkd](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/ovrwrkd/32/7586_2.png) [@Ovrwrkd](https://forums.speedlife.net/u/Ovrwrkd)\
**Post date:** [November 29, 2005, 4:09pm UTC](https://forums.speedlife.net/t/rick-help-spy-axe/5104/2 "2005-11-29T16:09:35Z")

</div>

Try Counter Spy. [http://www.sunbelt-software.com](http://www.sunbelt-software.com) I use it and haven’t had a problem yet.

---

<div class="post-metadata">

**Author:** ![MHill](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@MHill](https://forums.speedlife.net/u/MHill)\
**Post date:** [November 29, 2005, 5:07pm UTC](https://forums.speedlife.net/t/rick-help-spy-axe/5104/3 "2005-11-29T17:07:41Z")

</div>

Got it

None of the spyware soft ware did a thing

My cob job fix…

Looked in C:\Windows\system32 for any files modified recently

I knew the problem happened the last time i used my computer and knew i hadnt installed any new programs today.

Found a few files created last night

Couldnt delete at first because they were being used by the virus

Files suspect

svchost **s**.dll NOTICE THE EXTRA “s”  
mssearchnet or something to that effect  
and a couple others

the svchosts.dll is the suspect program

renamed the files to something arbitrary, asdfasd and such

restarted the computer and the virus couldnt start because it cant find the files it needs

now they were able to be deleted

restarted again and no errors and no virus

hope this thread helps anyone else in the future

---

<div class="post-metadata">

**Author:** ![Rx3](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/rx3/32/7194_2.png) [@Rx3](https://forums.speedlife.net/u/Rx3)\
**Post date:** [November 29, 2005, 5:11pm UTC](https://forums.speedlife.net/t/rick-help-spy-axe/5104/4 "2005-11-29T17:11:34Z")

</div>

Glad you got it fixed.

Check your registry for these too:

HKLM…\Run: [WildTangent CDA] “C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe” /startup “C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll”  
HKLM…\Run: [SpyAxe] C:\Program Files\SpyAxe\spyaxe.exe /h  
HKCU…\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1  
Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (HKCU)  
DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - [http://www.miniclip.com/supergerball/miniclipGameLoader.dll](http://www.miniclip.com/supergerball/miniclipGameLoader.dll)

Find and delete these files:  
C:\Program Files\AWS\WeatherBug\Weather.exe (also folder AWS)  
C:\Program Files\SpyAxe\spyaxe.exe (also folder SpyAxe)  
C:\WINDOWS\system32\hp6040.tmp