FavoriteMan Browser Plug-in Information
Moderate threats may profile users online habits or broadcast data back to a server with 'opt-out' permission. In most cases this type of threat is more along the lines of commercial type adware that offer a premium service in exchange for tracking your user online performance.
||FavoriteMan is an Internet Explorer Browser Helper Object (BHO). Every so often it connects to its controlling servers, which may direct it to download and install other programs and add entries to the IE Favorites menu or background Desktop.
FavoriteMan is a browser helper object that works as an installer for other annoying software and adds favorites to the Internet Explorer Favorites menu and on the PC desktop. Comes in a large number of variants.
FavoriteMan adds advertisers' web sites to the Favorites menu.
Unsolicited commercial software installed by different variants of FavorietMan may include: Transponder/VX2, Transponder/MSView, NetPal, ClickTheButton, ClientMan, ezCyberSearch toolbar, TopText, SideStep, MySearch/MySearch, BargainBuddy/Adp, eXactSearch, NewDotNet, IGetNet/v5, IGetNet/ClearSearch, HotBar, BrowserAid/BrowserPal, CometCursor/Toolbar, ShopAtHomeSelect, ISTbar/Aupdate, DailyWinner, nCase, KeenValue/v1, Mail.com Alerts (which also comes bundled with BargainBuddy/Apuc), Weatherbug (which also comes bundled with MySearch/MySearch), Freeze.com Living Waterfalls screensaver (which may also come bundled with Weatherbug, NewDotNet, SaveNow and Forbes.com Business Alerts, A1Tech AdsGone popup-killer and various homepage hijackers .
FavoriteMan seems to try to find your e-mail address on installation to send to its controlling servers. This may not work.
In the latest Grokster and iMesh bundles there is a section in the small print referring to the FavoriteMan software as NetPal. Mindset Interactive, the producers, seem to use the name "NetPal" to refer to any of their unsolicited commercial software, including FavoriteMan, NetPal and Transponder.
The Favorite, F1 and Mpz variants have been bundled with iMesh. The FOne variant is installed by the Lwz variant. The ZZ variant is bunded with Grokster as of January 2003. The Gr02 variant is bundled with Grokster as of June 2003. The IMZ variant is installed by the lop/IMZ parasite. The Gig variant is installed by software from TwistedHumor.com. ('Gig' refers to Gigatech Software, producers of the SuperBar parasite.) The Ss32 variant is installed by SpyAssault, a supposed spyware scanner from Razor Media LLC (who control this variant). The YsUp variant is installed by ActiveX drive-by download in pop-up adverts served by yesup.net.
FavoriteMan is written and controlled by Mindset Interactive, the same people behind the Transponder and NetPal spyware threats. There is a recent site marketing FavoriteMan at F1 Organizer (with traditional broken link to uninstaller).
||process: iehost.exe: MD5 Hash: 697ef09e8e20f18b105...
process: calsdr.exe: MD5 Hash: ecf4dea157857386595..
||Browser Plug-in - Adware is generally software that displays advertisements. Some advertisers may covertly install adware on your system and generate a stream of unsolicited advertisements that can clutter your desktop and affect your productivity. The advertisements may also contain pornographic or other material that you might find inappropriate. The extra processing required to track you or to display advertisements can tax your computer and hurt your system performance.
Top Browser Plug-in Visited Pages:
3721.com Chinese Keywords - Alias: 3721.com Chinese Keywords browser Spyware - 128 visits
Sexxxpassport Plug-in - Alias: Sexxxpassport.com, SEXXXPASSPORT - 97 visits
FavoriteMan - Alias: TrojanDownloader.Win32.Rameh, Windows Help 4 Smart Browsing, F1Organizer, ATPartners - 96 visits
Bulla - Alias: IEPlugin - 89 visits
EZSearch - Alias: ezSearching, ctavp - 81 visits
Netster SmartBrowse - Alias: Netster SmartBrowse Toolbar - 81 visits
My Way Speedbar - Alias: MyWayToolbar, MyWay Search Bar - 78 visits
MapQuest Toolbar - 77 visits
Trojan.BHO.NameShifter.T - 74 visits
Kugoo - 73 visits
Random Browser Plug-in Pages:
Begin2Search - Alias: Begin2Search Toolbar
SecondPower Multimedia Speedbar