FavoriteMan Description:

FavoriteMan is an IE Browser Helper Object. Every so often it connects to its controlling servers, which may direct it to download and install other programs and add entries to the IE Favorites menu or background Desktop.

At the time of writing, unsolicited commercial software known to be installed by the many different variants of FavoriteMan includes:

• Transponder/VX2
• Transponder/MSView
• NetPal
• ClickTheButton
• ClientMan
• ezCyberSearch toolbar
• TopText
• MySearch
• BargainBuddy/Adp
• eXactSearch
• NewDotNet
• IGetNet/v5
• IGetNet/ClearSearch
• HotBar
• BrowserAid/BrowserPal
• CometCursor/Toolbar
• ShopAtHomeSelect
• ISTbar/AUpdate
• DailyWinner
• nCase
• KeenValue/v1
• Mail.com Alerts (which also comes bundled with BargainBuddy/Apuc )
• Weatherbug (which also comes bundled with MySearch/MySearch )
• Freeze.com Living Waterfalls screensaver (which may also come bundled with Weatherbug, NewDotNet , SaveNow and Forbes.com Business Alerts.
• A1Tech AdsGone popup-killer
• various homepage hijackers

FavoriteMan/Ofrg 's program file is called ofrg.dll. It stores its data in a file called favboot.dll. Its controlling server is www.yourspecialoffers.com.

FavoriteMan/Favorite installs favorite.dll. Data file is FavMan.dll. Controlling server is also www.yourspecialoffers.com.

FavoriteMan/Lwz installs lwz.dll. Data file is SysLdr.dll. Controlling server is www.f1organizer.com.

FavoriteMan/F1 installs F1.dll. Data file is SysLdr.dll. Controlling server is www.prize4all.com.

FavoriteMan/FOne is a replacement for the Lwz variant. Filename is FOne.dll, data file is SysLdr.dll. Controlling server is www.f1organizer.com.

FavoriteMan/ZZ installs ZZ.dll. Data file is SysLdr.dll. Controlling server is www.f1organizer.com.

FavoriteMan/IMZ is installed with a pseudo-random filename. Data file is SysLdr.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Mpz installs mpz300.dll. Data file is mbr32.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Gig installs gig.dll. Data file is mbr32.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Trk installs trk.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Td1 installs td1.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Gr02 installs Gr02.dll. Data file is im64.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Aess installs Aess.dll. Data file is im64.dll. Controlling server is www.f1organizer.com.

FavoriteMan/Ss32 installs Ss32.dll. Controlling server is www.r-vision.org.

FavoriteMan/EMesX installs emesx.dll. Data file is dlh0st.dll. Controlling server is www.f1organizer.com.

Also known as: In the newest Grokster and iMesh bundles there is a section in the small print referring to the FavoriteMan software as NetPal . Mindset Interactive, the producers, seem to use the name "NetPal" to refer to any of their unsolicited commercial software, including FavoriteMan, NetPal and Transponder.

FavoriteMan Automatic Removal:

Using Spyware Doctor to detect and remove FavoriteMan AUTOMATICALLY!

FavoriteMan Manual Removal:

The software can be found in the System folder. On Windows 95/98/Me this is the folder called 'System' in the Windows folder; on Windows NT, 2000 and XP it is called 'System32'. Look for one of the filenames listed above.

Before you can delete the program file, you must deregister it. Open a DOS command prompt window (under Accessories in the Programs menu from 'Start') and enter the commands:

Change the filename 'favorite.dll' to match the variant you have. This can be ofrg.dll, favorite.dll, lwz.dll, F1.dll, ZZ.dll, mpz300.dll, trk.dll, Gr02.dll, Aess.dll, aess2.dll, Ss32.dll or emesx.dll; in in the case of the IMZ variant it will have a random eleven-letter filename. (eg. troallystbr.dll). You can usually find the culprit by opening the System folder choosing View->Arrange icons by->Modified, then looking near the bottom of the window.

After doing this and restarting the computer you can delete the file. You can also delete the data file favboot.dll, FavMan.dll, SysLdr.dll, mbr32.dll, im64.dll or dlh0st.dll in the same folder (it isn't a DLL at all), and the settings in the registry in the entries 'Counter', 'Server' and 'Object', hiding in HKEY_CURRENT_USER\Software\Microsoft\Windows.

More Removal Instructions for Adware/Spyware Programs - 'F'