FavoriteMan manual removal:
Delete registry values:HKEY_CLASSES_ROOT\F1.Organizer
HKEY_CLASSES_ROOT\F1.Organizer.1
HKEY_CLASSES_ROOT\NewFavorite.FavoriteMan
HKEY_CLASSES_ROOT\NewFavorite.FavoriteMan.1
HKEY_CLASSES_ROOT\Ro_tater.Class1
HKEY_CLASSES_ROOT\CLSID\{00000EF1-0786-4633-87C6-1AA7A44296DA}
HKEY_CLASSES_ROOT\CLSID\{A61BF823-2770-4038-9D26-348CAA0AC7A3}
HKEY_CLASSES_ROOT\CLSID\{EF100007-F409-426A-9E7C-CB211F2A9786)
HKEY_CLASSES_ROOT\CLSID\{EBBD88E5-C372-469D-B4C5-1FE00352AB9B}
HKEY_CLASSES_ROOT\Interface\{6BDAB517-CC58-4AA1-9FA4-B645D4AFDB5C}
HKEY_CLASSES_ROOT\TypeLib\{3F44A502-E104-4D3B-95EC-C3B886E25A16}
HKEY_CLASSES_ROOT\TypeLib\{EB5E961F-F519-303C-9744-0D4376B1B0B5}
HKEY_CLASSES_ROOT\TypeLib\{EF100007-F409-426A-9E7C-CB211F2A9786)
HKEY_CURRENT_USER\Software\Microsoft\Windows\Counter
HKEY_CURRENT_USER\Software\Microsoft\Windows\Object
HKEY_CURRENT_USER\Software\Microsoft\Windows\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000EF1-0786-4633-87C6-1AA7A44296DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EBBD88E5-C372-469D-B4C5-1FE00352AB9B}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\DMO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DMO
Unregister DLLs:atpartners.dll, benceed.dll, casldr.dll, emesx.dll, f1.dll, favboot.dll, favman.dll, favorite.dll, fone.dll, gig.dll, iaicm.dll, iaint.dll, im64.dll, lwz.dll, ofrg.dll, ss32.dll, trk.dll, zz.dll
Delete files:atpartners.dll, benceed.dll, casldr.dll, emesx.dll, f1.dll, favboot.dll, favman.dll, favorite.dll, fone.dll, gig.dll, iaicm.dll, iaint.dll, im64.dll, lwz.dll, ofrg.dll, ss32.dll, trk.dll, zz.dll
Misc:The parasite doesn't install all listed files and registry entries, but adds only few of them. Listed objects belong to several widely spread FavoriteMan variants.
All FavoriteMan files can be found in the default system directory, which is one of the following: C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32.
Comments from visitors:
1. by Tester. 2004-03-04 19:46:51
Update: They seems to be releasing more and more different variants, seemingly programmed to install other spyware/adware remotely.