Windows Security Tutorials - Herong's Tutorial Examples

∟Malware Manual Removal Experience

∟Removing "Best Offer" - farmmext.exe

This section provides a tutorial example on remove spyware 'Best Offer' and related files farmmext.exe.

Symptom: After IE (Internet Explorer) was launched, some "Best Offer" IE windows popped up randomly offering on-line product marketing pages.

HijackThis Report: 

... C:\WINDOWS\farmmext.exe

Quick Research: I did a Google search on "C:\WINDOWS\farmmext.exe" and located a good description from http://www.malwhere.com/processes/farmmext.exe.html: 

farmmext.exe is a process associated with the Transponder parasite. 
It monitors your online activities and opens pop-ups based on it. 
This process should be removed to protect your personal privacy.

Another page, http://www.doxdesk.com/parasite/Transponder.html, gives a very detailed introduction on this transponder, and says that it is responsible for the "Best Offer" popup IE windows.

What I Did:

1. Looked at C:\WINDOWS\farmmext.exe, found the file, and deleted it: 

>dir C:\WINDOWS\farmmect.*
   farmmext.exe
   farmmext.ini

>del C:\WINDOWS\farmmect.*

Result: "Best Offer" windows are still popping up. I need to work on this more.

Table of Contents

 About This Windows Security Book

 Windows 8: System Security Review

 Windows 8: System Security Protection

 Windows 8 System Recovery

 Windows 8 Defender for Real-Time Protection

 Windows 7: System Security Review

 Windows 7: System Security Protection

 Windows 7 System Recovery

 Windows 7 Forefront Client Security

 Norton Power Eraser - Anti-Virus Scan Tool

 McAfee Virus and Malware Protection Tools

 Spybot - Spyware Blocker, Detection and Removal

 Keeping Firefox Secure

 Keeping IE (Internet Explorer) Secure

 Malware (Adware, Spyware, Trojan, Worm, and Virus)

 HijackThis - Browser Hijacker Diagnosis Tool

 IE Add-on Program Listing and Removal

 "Conduit Search" - Malware Detection and Removal

 "Tube Dimmer", "Scorpion Saver" or "Adpeak" Malware

►Malware Manual Removal Experience

 Removing Malware "Social Privacy DNS"

 Removing "WebBar" - htwtb.bin and bar.dll

 Removing "SurfBuddy" - sbuddy.dll

 Removing "WebSpecials" - webspec.dll

 Removing "DSSAgent" - DSSAgent.exe

►Removing "Best Offer" - farmmext.exe

 Removing "dinst.exe" - dsr.dll

 Removing "deSrcAs.dll" - MyWay Search Assistant

 WinAntiVirusPRO 2006 Faked Security Popup

 WinFixer 2006 Faked Security Popup

 Removing "WinFixer" - Rogue Security Popups

 Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal

 Trojan and Malware "Puper" Description and Removal

 VSToolbar (VSAdd-in.dll) - Description and Removal

 PWS (Password Stealer) Trojan Infection Removal

 MS08-001 Vulnerability on Windows Systems

 Antivirus System PRO

 References

 Full Version in PDF/ePUB