This section provides a tutorial example on remove spyware 'Best Offer' and related files farmmext.exe.
Symptom: After IE was launched, some "Best Offer" IE windows popped up randomly offering on-line
product marketing pages.
HijackThis Report: I ran HijackThis on my friend's system and saw this line:
... C:\WINDOWS\farmmext.exe
Quick Research: I did a Google search on "C:\WINDOWS\farmmext.exe"
and located a good description from http://www.malwhere.com/processes/farmmext.exe.html:
farmmext.exe is a process associated with the Transponder parasite.
It monitors your online activities and opens pop-ups based on it.
This process should be removed to protect your personal privacy.
Another page, http://www.doxdesk.com/parasite/Transponder.html, gives a very detailed introduction
on this transponder, and says that it is responsible for the "Best Offer" popup IE windows.
What I Did:
1. Looked at C:\WINDOWS\farmmext.exe, found the file, and deleted it:
