Windows Tutorials - Herong's Tutorial Examples - Version 5.62, by Dr. Herong Yang
Transponder: Best Offer - farmmext.exe
This section provides a tutorial example on remove spyware 'Best Offer' and related files farmmext.exe.
Symptom: After IE was launched, some "Best Offer" IE windows popped up randomly offering on-line product marketing pages.
HijackThis Report: I ran HijackThis on my friend's system and saw this line:
Quick Research: I did a Google search on "C:\WINDOWS\farmmext.exe" and located a good description from http://www.malwhere.com/processes/farmmext.exe.html:
farmmext.exe is a process associated with the Transponder parasite. It monitors your online activities and opens pop-ups based on it. This process should be removed to protect your personal privacy.
Another page, http://www.doxdesk.com/parasite/Transponder.html, gives a very detailed introduction on this transponder, and says that it is responsible for the "Best Offer" popup IE windows.
What I Did:
1. Looked at C:\WINDOWS\farmmext.exe, found the file, and deleted it:
>dir C:\WINDOWS\farmmect.* farmmext.exe farmmext.ini >del C:\WINDOWS\farmmect.*
Result: "Best Offer" windows are still popping up. I need to work on this more.
Table of Contents