|
Removing Spyware
Part:
1
2
3
4
5
(Continued from previous part...)
Transponder - Best Offer - farmmext.exe
Symptom: After IE was launched, some "Best Offer" IE windows popped up randomly offering on-line
product marketing pages.
HijackThis Report: I ran HijackThis on my friend's system and saw this line:
... C:\WINDOWS\farmmext.exe
Quick Research: I did a Google search on "C:\WINDOWS\farmmext.exe"
and located a good description from http://www.malwhere.com/processes/farmmext.exe.html:
farmmext.exe is a process associated with the Transponder parasite.
It monitors your online activities and opens pop-ups based on it.
This process should be removed to protect your personal privacy.
Another page, http://www.doxdesk.com/parasite/Transponder.html, gives a very detailed introduction
on this transponder, and says that it is responsible for the "Best Offer" popup IE windows.
What I Did:
1. Looked at C:\WINDOWS\farmmext.exe, found the file, and deleted it:
>dir C:\WINDOWS\farmmect.*
farmmext.exe
farmmext.ini
>del C:\WINDOWS\farmmect.*
Result: "Best Offer" windows are still popping up. I need to work on this more.
Spyware - dinst.exe - dsr.dll
Symptom: Once a while, a Windows alert window pops up and says:
dinst.exe - Bad Image
The application or DLL c:\windows\dsr.dll is not a valid Windows image.
Please check this against your installation diskette.
HijackThis Report: I ran HijackThis on my friend's system and saw these lines:
... c:\windows\dsr.dll
... c:\windows\dinst.exe
Quick Research: I did a Google search on "Remove dsr.dll"
and located some good information from http://answers.google.com/answers/threadview?id=550004.
What I Did:
1. Looked at c:\windows\dsr.exe, found the file, and deleted it:
>del c:\windows\dsr.exe
>del c:\windows\dsr.dll
>del c:\windows\dinst.exe
Result: The alert window is gone.
Conclusion
- Spyware is very annoying and dangerous. You must remove it from your system.
- HijackThis is good tool for fighting against spyware.
- Removing spyware is not an easy job.
- To reduce the chance of getting spyware into your system, you should stop use IE and start to FireFox.
Part:
1
2
3
4
5
| 