Quick Links: SpywareGuide Greynets Blog | SpywareGuide Product Database | SpywareGuide Company Database | SpywareGuide Categories
Search SpywareGuide Database & Site
Security Email Alerts & Updates
SpywareGuide powered by FaceTime Security Labs
Full Name:
FavoriteMan Websearch
Type: Adware
Also Known as: ofrg Lwz F1 Emesx.dll
Created by: Razor Media LLC
SG Index: 3 [Explain]
Removal tools: List of products that detect/remove/protect against FavoriteMan:
  • Desktop Anti-malware: Pro User: X-Cleaner
  • Control IM and P2P use, block spyware and other malware: RTGuardian
  • Endpoint Spyware Remediation: Greynet Enterprise Manager
  • IM, P2P control, malware prevention and web filtering in single appliance: Unified Security Gateway
  • Category Description: Program that delivers advertisements on your PC.

    Note that many websites have their own advertising, unrelated to adware.

    Adware is any software application in which advertising is displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen and sometimes through text links or in integrated search results. Adware may or may not track personal information. It may also gather information anonymously or in aggregate only. Users should check the EULA and Privacy policy to ensure if the adware on their machines conforms to their standards.
    Official Description: FavoriteMan is an IE Browser Helper Object. It connects to the web site "yourspecialoffers.com" and, when directed to do so by the command files stored on that site, adds entries to the IE Favorites menu, and installs other software such as Transponder/VX2, NetPal and ClickTheButton.
    Comment: FavoriteMan attempts to find your e-mail address from Outlook or Outlook Express and sends it on first use. Unlike the other parasites from Mindset, however, it does not seem to send a log of URLs browsed.

    Update: They seems to be releasing more and more different variants, seemingly programmed to install other spyware/adware remotely.
       
    Manual removal: The software installs ofrg.dll into your Windows System directory. Before you can delete this file you will need to deregister it. Enter the following command from the command line :

    "%WinDir%\SYSTEM\regsvr32.exe" /u "%WinDir%\SYSTEM\ofrg.dll"

    Remove these files if present:

    systemroot+\system32\arb1tal.dll
    systemroot+\system32\emesx.dll
    systemroot+\system32\f1.dll
    systemroot+\system32\favboot.dll
    systemroot+\system32\favman.dll
    systemroot+\system32\favorite.dll
    systemroot+\system32\fone.dll
    systemroot+\system32\gr02.dll
    systemroot+\system32\im64.dll
    systemroot+\system32\lwz.dll
    systemroot+\system32\mbr32.dll
    systemroot+\system32\mpz300.dll
    systemroot+\system32\n3tpa1p.dll
    systemroot+\system32\ofrg.dll
    systemroot+\system32\pdfzzy.dll
    systemroot+\system32\ss32.dll
    systemroot+\system32\sysldr.dll
    systemroot+\system\emesx.dll
    systemroot+\system\f1.dll
    systemroot+\system\favboot.dll
    systemroot+\system\favman.dll
    systemroot+\system\favorite.dll
    systemroot+\system\fone.dll
    systemroot+\system\im64.dll
    systemroot+\system\lwz.dll
    systemroot+\system\n3tpa1p.dll
    systemroot+\system\ofrg.dll
    systemroot+\system\ss32.dll
    systemroot+\system\sysldr.dllaess2.dll
    Properties:
  •  Autostarts/Stays Resident
  •  Changes browser
  •  Connects to the internet
  •  Shows Advertisements
  •  Stealth Tactics
  • Click here to leave feedback for this product

    Help with the BUST!
    Click here and give us what details you have and let our international research team take it from there. If you desire your report will remain anonymous.
    Recent Blog Posts
  • "Interesting" Advert Placements On Facebook
  • Content Scrapers And Security Blogs
  • Your 419 Mail Roundup
  • Social Networking: When It All Goes Horribly Wrong
  • The Angry Spamtool...
  • Fast Track to Botnet Central
  • My Name......is......Neo!
  • The Time, The Place....
  • Credit Card "Hack Pack" Is Flavour Of The Month With Script Kiddies
  • An Old Classic Doing The Rounds...
  • Recent Modifications
    2008-7-4  Proxy based anonymizers
    2008-7-3  PW.Steal.MMMR
    2008-7-1  Smiddy
    2008-6-30  OnlineH.FOK
    2008-6-27  FastTrackBot
    2008-6-27  FraudTool-AntiSpySpider
    2008-6-27  PCI.Load
    2008-6-27  VideoPorn
    2008-6-27  AceNotes
    2008-6-27  Advanced Cleaner
     

    Site EULA | Site Map | Contact Us | About Us | Site and Spyware FAQ | Advertise | RSS Feeds  | Link To Us | SpywareGuide Japan Japanese

    © Copyright 2007, FaceTime Communications, Inc. All rights reserved.