Farmmext.exe keeps on downloading itself, please help!

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I keep on finding farmmext.exe and its related files in C:\Windows and
C:\WIndows\LastGood even though I have removed them by SPySweeper.

It is pretty annoying that the spyware is repeatedly embedding itself onto
my computer. And using Spyware removal tools doesn't prevent further
appearances of farmmext.exe.

Spysweeper does detect a Trojan downloader sort of stuff but cannot stop
from downloading farmmext.exe again. It basically redownloads itself every
hour or so when I am connected onto the Internet.

I have checked with MSConfig and nothing weird there. All I want to know is
the thing that is triggering the download. BTW, my IP is not static.

Thanks.
3 answers Last reply
More about farmmext downloading itself help
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Check this site out, manual removal instructions included:
    http://www.doxdesk.com/parasite/Transponder.html

    "hotingzilla" <hotingzilla@discussions.microsoft.com> wrote in message
    news:2F9FBA96-F45B-4F7B-94B8-659F28F1ED14@microsoft.com...
    >I keep on finding farmmext.exe and its related files in C:\Windows and
    > C:\WIndows\LastGood even though I have removed them by SPySweeper.
    >
    > It is pretty annoying that the spyware is repeatedly embedding itself onto
    > my computer. And using Spyware removal tools doesn't prevent further
    > appearances of farmmext.exe.
    >
    > Spysweeper does detect a Trojan downloader sort of stuff but cannot stop
    > from downloading farmmext.exe again. It basically redownloads itself every
    > hour or so when I am connected onto the Internet.
    >
    > I have checked with MSConfig and nothing weird there. All I want to know is
    > the thing that is triggering the download. BTW, my IP is not static.
    >
    > Thanks.
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Thanks but I just did. The script on their website detected a
    transponder/pynix installed, but I cannot find them by following their
    instructions.

    However, I noticed something special. After I realized this problem, I
    opened up a Guest account, and ever since, farmmext.exe have not been
    redownloaded. Nothing suspicious so far. So can anyone tell me where I should
    look now (Guest account may be a clue) in order to remove it from my main
    account?

    Thanks.

    "Taurarian" wrote:

    > Check this site out, manual removal instructions included:
    > http://www.doxdesk.com/parasite/Transponder.html
  3. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Copied from Wes
    MS-MVP Windows Shell/User

    farmmext.exe is a process associated with the Transponder parasite. It
    monitors your online activities and and opens pop-ups based on it. This
    process should be removed to protect your personal privacy.
    http://www.liutilities.com/products/wintaskspro/processlibrary/farmmext/

    doxdesk.com: database: Transponder
    http://www.doxdesk.com/parasite/Transponder.html

    Transponder is bundled with a myriad of programs, such as "AudioGalaxy
    Satellite", "Internet Accelerator" and "NetTurbo".
    Transponder
    http://www.kephyr.com/spywarescanner/library/transponder/index.phtml

    Spyware, In a Galaxy Near You
    http://www.wired.com/news/technology/0,1282,49960,00.html

    Steer clear of Microsoft Windows AntiSpyware (BETA) until it's ready for
    public release. It has too many problems yet!!!!

    Some of this does not apply if you have Windows XP SP2. If you do not have
    SP2, get it

    First. Make sure of these settings and nothing will install without you
    answering YES. (Except what may install as part of some other software.)
    Don't click YES if you don't know/trust the source.

    Start | Settings | Control Panel | Internet Options | Advanced tab |
    Make sure both of these are NOT checked.

    Enable Install On Demand (Internet Explorer)
    [[Specifies to automatically download and install Internet Explorer
    components if a Web page needs them in order to display the page properly or
    perform a particular task.]]

    Enable Install On Demand (Other)
    [[Specifies to automatically download and install Web components if a Web
    page needs them in order to display the page properly or perform a
    particular task.]]

    Apply | OK

    Enable Install On Demand (Other)
    Is part of the driveby downloading of unwanted programs. i.e. Scumware or
    whatever will install w/o you even being aware of it.
    =====

    Second. If you need a scan right now.

    Follow the instructions!
    THE PARASITE FIGHT QUICK FIX PROTOCOL
    http://aumha.org/a/quickfix.php

    =====

    Third.
    It is known as scumware. Visit these sites. 1, 2, 3 and 4 are really good.
    Download, install, run, update and run again; one or all. They are all
    good, FREE utilities. Make sure you update every program, even if you
    just downloaded it. You must have the latest updates. Without updates,
    you have a gun without ammo. You also need to use more than one
    anti scumware program. One program will not catch everything.

    1) CWShredder ver. 1.59 direct download:
    http://www.merijn.org/files/cwshredder.zip

    1a) CWShredder ver. 2.0 direct download:
    http://www.aumha.org/downloads/cwshredder.zip

    2) SpywareBlaster
    [[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
    ever being installed.
    The most important step you can take is to secure your system. And
    SpywareBlaster is the most powerful protection program available.]]
    http://www.javacoolsoftware.com/spywareblaster.html

    3) Spybot S & D (More for the advanced user)
    http://www.safer-networking.org/index.php?lang=en&page=download

    4) HijackThis (More for the advanced user)
    http://www.spywareinfo.com/~merijn/downloads.html

    4a) HijackThis (direct download)
    http://aumha.org/downloads/hijackthis.zip

    5) Bazooka Adware and Spyware Scanner v1.13
    http://www.kephyr.com/spywarescanner/index.html?source=appvisit

    6) ToolbarCop
    http://www.mvps.org/sramesh2k/toolbarcop.htm

    7) Ad-aware SE Personal
    http://www.lavasoft.de/support/download/

    =====

    HijackThis log tutorial
    http://www.spywareinfo.com/~merijn/htlogtutorial.html

    HijackThis Log Tutorial
    http://www.aumha.org/a/hjttutor.htm

    How to use HijackThis to remove Browser Hijackers & Spyware
    http://www.bleepingcomputer.com/forums/index.php?showtutorial=42#warning

    How To Install Spybot Search and Destroy & a brief tutorial
    http://tomcoyote.com/SPYBOT/index1.php

    HOW TO: Reconfigure Ad-aware for a Full Scan
    http://forum.aumha.org/viewtopic.php?t=5877
    =====

    MVPS HOSTS file is a free download from:
    http://www.mvps.org/winhelp2002/

    Blocking Unwanted Parasites with a Hosts File
    http://www.mvps.org/winhelp2002/hosts.htm
    =====

    Problems uninstalling? Here's some advice.
    http://www.kephyr.com/spywarescanner/uninstallproblems.phtml

    Additional information & instructions.
    A wealth of information here, boys and girls.

    THE PARASITE FIGHT QUICK FIX PROTOCOL
    http://aumha.org/a/quickfix.htm

    THE PARASITE FIGHT
    Finding, Removing & Protecting Yourself From Scumware
    http://aumha.org/a/parasite.htm

    Bugs, Glitches & Stuffups
    http://www.mvps.org/inetexplorer/Darnit.htm

    Dealing with Unwanted Spyware and Parasites
    http://mvps.org/winhelp2002/unwanted.htm

    Unexplained computer behavior may be caused by deceptive software
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315

    Spyware and Deceptive Software
    http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

    What you should know about spyware
    http://www.microsoft.com/security/articles/spyware.asp

    Cleaning Up XP
    http://www.kellys-korner-xp.com/xp_c.htm#cleanup
    --
    Hope this helps. Let us know.

    Wes
    MS-MVP Windows Shell/User


    hotingzilla wrote:
    > Thanks but I just did. The script on their website detected a
    > transponder/pynix installed, but I cannot find them by following their
    > instructions.
    >
    > However, I noticed something special. After I realized this problem, I
    > opened up a Guest account, and ever since, farmmext.exe have not been
    > redownloaded. Nothing suspicious so far. So can anyone tell me where
    > I should look now (Guest account may be a clue) in order to remove it
    > from my main account?
    >
    > Thanks.
    >
    > "Taurarian" wrote:
    >
    >> Check this site out, manual removal instructions included:
    >> http://www.doxdesk.com/parasite/Transponder.html
Ask a new question

Read More

Windows XP