NetPal is an IE Browser Helper Object from Mindset Interactive, the people behind Transponder . It does similar things to the Transponder range, but is quite different internally.

Also known as

PrizePopper (the internal name of the DLL, and a possibly related web site), Tracker or TrackIExplore (BHO name).

Distribution

Was installed by the FavoriteMan trojan, possibly also bundled with other software. Is downloadable through ActiveX at the site www.netpalnow.com; however, that site also used to distribute the original Transponder parasite under the same 'NetPal' name.

Advertising

Yes. Opens large pop-up adverts when directed to do so by its controlling servers.

Privacy violation

Yes. Sends URLs visited and terms entered into forms to its controlling servers. If e-mail addresses are configured in Outlook or Outlook Express it will send them to, to be sold for junk e-mail.

Security issues

Yes, seems to have an automatic silent update function (though I have not yet observed it in action). It also apparently sometimes tampers with the security settings for the Internet Zone, although it only seems to enable the deafult settings. (?)

Stability problems

Yes. Internet Explorer hung up for random periods of time whilst I was testing it.

Removal

Ad-Aware can detect and remove Netpal.

Manual removal

The software installs netpal.dll into your Windows System directory. Before you can delete this file you will need to deregister it. Enter the following commands from the command line for Windows 95/98/Me:

Or for Windows NT/2000/XP just:

After doing this and restarting the computer you can delete the file. You can also delete 'kernellos.dll' in the same directory, which is a data file used by NetPal (and isn't a DLL at all), and the registry key HKEY_LOCAL_MACHINE\Software\Destiny.