Getting rid of this spyware: axvgimecqx.exe

[Garibaldi]

Hello Everyone,

I've had this annoying program try to access the internet (my firewall alerts me and stops it) every time I try to fill in a field on the internet, like enter a username and password for a forum. The program is called "buddy" by my firewall, and the .exe file is located in /windows/ as axvgimecqx.exe. I've tried ad-aware and spybot to try and disable it but they haven't found it. Any ideas on how to get rid of this?

[VenGeanCe]

well m8 does the file run on connecting to the net/startup if yes i think it will be available in msconfig try 2 disable from there.try cyberscrub it will remove the shit registry values.mostly such shit proggy's r found in c:\program files\common files

[Garibaldi]

well m8 does the file run on connecting to the net/startup if yes i think it will be available in msconfig try 2 disable from there.try cyberscrub it will remove the shit registry values.mostly such shit proggy's r found in c:\program files\common files

I don't see it in msconfig. I'll google cyberscrub and give that a try thanks.

[ViRaL1]

It probably won't be listed in MSCONFIG as such. Some spyware, such as CoolWebSearch use randomly generated file names. Look through MSCONFIG for anything that you don't recognize, or anything with a name that looks like gibberish. If you're not sure about it before unchecking it, Google to see what you find. It's rare that you'll screw anything up by unchecking it. Worst case scenario, you just recheck it on next boot if it's needed. The best places to look for a lot of those randomly generated files are C:\WINDOWS and C:\WINDOWS\SYSTEM32 but that CAN be anywhere.

[Garibaldi]

It probably won't be listed in MSCONFIG as such. Some spyware, such as CoolWebSearch use randomly generated file names. Look through MSCONFIG for anything that you don't recognize, or anything with a name that looks like gibberish. If you're not sure about it before unchecking it, Google to see what you find. It's rare that you'll screw anything up by unchecking it. Worst case scenario, you just recheck it on next boot if it's needed. The best places to look for a lot of those randomly generated files are C:\WINDOWS and C:\WINDOWS\SYSTEM32 but that CAN be anywhere.

Ok thanks, I'm running the virus scan now and I'll give that a try next.

[redwudz]

You could have bargain buddy or bonzi buddy, both nasty. You can do a Google search for the two to see which one it is. The exe, axvgimecqx.exe, is probably a name generated at random.

What ViRaL1 says about the gibberish name in processes. They often have a combo of lower and higher case letters and numbers.

The bad news about the 'buddy' programs is that a lot of other spyware/trojans are often installed with them. They can reside in the restore file (Of XP) and reestablish themselves after a restore. Sometimes very hard to kill.

Best advice, boot in safe mode, turn off system restore, disconnect from the internet and try to do the removals as recommended by the antispyware sites.

Good luck.

[Garibaldi]

You could have bargain buddy or bonzi buddy, both nasty. You can do a Google search for the two to see which one it is. The exe, axvgimecqx.exe, is probably a name generated at random.

What ViRaL1 says about the gibberish name in processes. They often have a combo of lower and higher case letters and numbers.

The bad news about the 'buddy' programs is that a lot of other spyware/trojans are often installed with them. They can reside in the restore file (Of XP) and reestablish themselves after a restore. Sometimes very hard to kill.

Best advice, boot in safe mode, turn off system restore, disconnect from the internet and try to do the removals as recommended by the antispyware sites.

Good luck.

Wow so it sounds pretty serious!!

I'm going to run this anitivirus and see if that helps, otherwise I'll try the safemode version (it doesn't have networking anyway so the internet isn't a problem). I guess my best solution would be to just boot up my Slackware install.... :P

[VenGeanCe]

@gabri well just google for a software named regfreeze its got around 20,000 spyware definitions it can remove many spyware/malware keys try that 1 also