Can't get rid of BargainBuddy

[Soren Lindgaard]

Hi,

It seems like I have encountered a particularly nasty
instance of the hated BargainBuddy adware component. Every
reboot makes that annoying DOG icon pop up in just another
system tray. Seems like the spyware dropped some DLL files
into my Windows directory and keys into the registry that
trigger reinstallation even if I manage to delete it.
Microsoft Anti-spyware is uncapable of handling the
spyware. It could be that the reinstallation components
are difficult to track down...? I might succeed in
banishing the main components for my current session, but
as soon as I reboot, the spyware reinstalls.

I managed to get rid of the nasty thing from the
C:\WINDOWS\TEMP\VSC9F6.ECE, but after a reboot that little
creature showed up in a new folder with a different
name;C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\AHAF67.EXE.


Path: C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\AHAF67.EXE
Name: AHAF67.EXE
EXE Name:
EXE InternalName:
EXE LegalCopyright:
EXE Desc:
EXE Author:
OS: Windows XP
Windows:
Comments:

 

[Danny Kile]

Hi,

It seems like I have encountered a particularly nasty
instance of the hated BargainBuddy adware component. Every
reboot makes that annoying DOG icon pop up in just another
system tray. Seems like the spyware dropped some DLL files
into my Windows directory and keys into the registry that
trigger reinstallation even if I manage to delete it.
Microsoft Anti-spyware is uncapable of handling the
spyware. It could be that the reinstallation components
are difficult to track down...? I might succeed in
banishing the main components for my current session, but
as soon as I reboot, the spyware reinstalls.

I managed to get rid of the nasty thing from the
C:\WINDOWS\TEMP\VSC9F6.ECE, but after a reboot that little
creature showed up in a new folder with a different
name;C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\AHAF67.EXE.


Path: C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\AHAF67.EXE
Name: AHAF67.EXE
EXE Name:
EXE InternalName:
EXE LegalCopyright:
EXE Desc:
EXE Author:
OS: Windows XP
Windows:
Comments:

Try this site:

http://www.pchell.com/support/bargainbuddy.shtml

Danny

 

[Steve Dodson [MSFT]]

Thank you for sharing your experience in the beta of Microsoft Windows
AntiSpyware. As with any beta product we are actively seeking ways to
improve the product and feedback like yours is an important part of this
work. To help us better understand your experience please submit a
suspected spyware report to us through the application by clicking Tools ->
Suspected Spyware Report.
Once the report is submitted, please view your completed report from SpyNet
and reply back to the newsgroup with the ScanID listed in the web browser.

An example ScanID would be: ScanID=732e5e60-d3b5-4c4e-926a-f7a7a7db5d79


--
-steve

Steve Dodson [MSFT]
MCSE, CISSP
PSS Security

--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[pav]

Have a look in your temp directory, and you might find
the bargin buddy exe file. when I was fixing some ones PC
this programe kept reinstalling itself, and thats where I
found the file. I just deleted it ran spy bot and adware
and the was no sign of it again.