COMPLETE SPYAXE SOLUTION: READ!!

Question

I tried to put it all in very simplistic terms for people that aren't that computer savvy to understand. It was quite a challenge for me to say the least. If I forgot something please let me know
Start your computer and push "F8" vigorously till you come to a black screen. At the top of the black screen you'll see "Safe mode", using your arrows scroll up, highlight it and hit "enter". This will take you to a screen that will allow you to access your desktop. Wait till your desktop appears. Go to start menu...then click "search"...then click "files and folders in C Drive"...then search for "ioctrl.dll"...right click on "ioctrl.dll" and at the bottom you'll see "rename"...rename it to "ioctrl.old"...then restart your computer in normal mode and it shouldn't show up in the icon tray. Using the same process to search for a file as I stated above from the start menu, find the file "ioctrl.old"...right click it and hit delete...it should take a short trip to your recycle bin...now delete it from there also...nice huh...it works

The file responsible for taking you to http://www.updateyoursystem.com instead of your homepage is c:\windows\system32\hpA75B.tmp. This file was put on your system by the good ole SpyAxe folks. I was having the same problem until I figured out that this file was causing this. Delete this file and this problem will stop.

It would also probably be a good idea to delete anything in "System32" that has shown up there since the whole problem started...all this really isn't that diffucult...GOOD LUCK!!

PS >> Instead of the file "ioctrl.dll", you might find "svchosts.dll", just rename the "dll" part to "old" it should work for either one.

Paul :)

phorr20 · Answer

And don't forget to empty your 'recycle bin' of all this CRAPOLLA after you are finished.   Questions??   Paul :)

phorr20 · Answer

Do you have a 'spyaxe icon' blinking down in your icon tray on the bottom right of your screen that keeps giving you a little pop-up down there saying you've been infected or something? If so, the above solution is the only one I know of. It has worked for me and you're the first person that it hasn't worked for that I know of. If you don't have this problem and only have the highjacking problem, I'm not sure if I know what it is. The only way the highjacking has occurred that I know of is through the spyaxe problem. If you follow these instructions it might...and I say 'might' help:   The file responsible for taking you to http://www.updateyoursystem.com instead of your homepage 'might' be this one >>>> c:\windows\system32\hpA75B.tmp. Search system32 folder and see if it's there...if it is I would delete it...from the recycle bin also. As always...Good luck!!   Paul :)

Ellsworth187 · Answer

Hi, i did exactly as you said but neither ioctrl.dll nor svchosts.dll came up in the search in safe mode. i too am highjacked to http://www.yoursystemupdate.com/ when i fire up IE. my norton antivirus finds adware.favoriteman as an infected file that i assume is causing my problems. i've been on a lot of sites trying to rid my Dell of this mess but cannot ever find a spyware remover that will disinfect my computer of this.

oh, when i get highjacked to http://www.yoursystemupdate.com/ is says i have been infected by W32.Sinnaka.A@mm however i'm not putting much stock in that and think the adware.favoriteman is my true issue.

thanks in advance for any suggestions.

i have even gone through all 4 steps recommended on symantec's website for this adware threat here http://securityresponse.symantec.com/avcenter/venc/data/adware.favoriteman.html and still cannot rid my system of it. i'm about to just throw in the towel.

Message Edited by Ellsworth187 on 12-13-2005 09:08 PM

Ellsworth187 · Answer

Hi,

nothing in system32 matching what you wrote, but there are some hp8 files and hpD files. all of which have been motified on or after my initial issue arose.

Message Edited by Ellsworth187 on 12-14-2005 08:23 PM

wsayed4 · Answer

the above solution worked for me.. thanks! I also deleted everything that was modified when the problem started happening. i.e.  hpA75B.tmp, ioctrl.dll, etc.... I also went through my registry's (start > run > regedit) and searched and deleted anything that had to do with ioctrl.dll.

BellaOB · Answer

Hi, when I reboot into safe mode and then try to search for the 'ioctrl.dll' file, my keyboard and mouse freeze up! and I have to hardboot just to get back to normal mode. what happening in safe mode that's causing my keyboard/mouse to freeze??? everything thing still seems active ie. blinking cursor, but I can't type anything or move the mouse arrow. what gives???

Ellsworth187 · Answer

is it safe to delete and delete from recycling folder the following without causing system problems?? thinking one of these might be responsible for my IE hijacking to updateyoursystem.com and getting the pop up windows.....

hpD294.tmp hpDFFF.tmp hp 6968.tmp hp6F15.tmp

wsayed4 · Answer

'Hi, when I reboot into safe mode and then try to search for the 'ioctrl.dll' file, my keyboard and mouse freeze up! and I have to hardboot just to get back to normal mode. what happening in safe mode that's causing my keyboard/mouse to freeze??? everything thing still seems active ie. blinking cursor, but I can't type anything or move the mouse arrow. what gives??? ' hmmm... you may have some other spyware installed on your computer too. Run the following free spyware scanner from the ZONE LABS. See what exactly you have on your pc. http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?dc=12bms&ctry=US〈=en 'is it safe to delete and delete from recycling folder the following without causing system problems?? thinking one of these might be responsible for my IE hijacking to updateyoursystem.com and getting the pop up windows..... hpD294.tmp hpDFFF.tmp hp 6968.tmp hp6F15.tmp' what I did is delete all the above .tmp files... and then I aslo cleaned up the pluging extension for Internet Explorer that was installed by this spyware. (Tools > internet options > settings > view objects > delete the correct plugin.

dchoice · Answer

Phorr20....Do you have a fix for Spyware Strike? It seems to be very similar to Spyaxe. Thanks.

Virus & Spyware

COMPLETE SPYAXE SOLUTION: READ!!

Was this post helpful?