Adware BargainBuddy Spyware
Type: Adware (Previously called Spyware)
Publisher: exact AdvertisingSystems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
This spyware threat can be detected only by free Spyware Scanner software that support expanded threats.
The Spyware's Behavior
Spyware 'BargainBuddy' is an adware program that downloads and displays advertisements.The spyware files will be able to be detected as Adware under the file name(s) BargainBuddy.
The adware program would have to be be manually installed. There are several known programs that have BargainBuddy adware within them, however, and that can install the spyware when the program itself is installed.
File names: Apuc.dll; Bargains.exe
Adware 'BargainBuddy' is an adware program that displays advertisements. The installer of the spyware application will not display any information on the screen. BargainBuddy's adware relies on the application that installs it to display the End User License Agreement (EULA).
When BargainBuddy's Spyware is executed, it performs the following
Creates the folder, C:\Program Files\ Bargain Buddy, and then inserts several files and subfolders within this folder.Creates the following registry keys:
HKEY_LOCAL_MACHINE\Software\Bargains
HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows\CurrentVersion\Run, "Bargains"="C:\Program Files\ Bargain Buddy\bin\bargains.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows\CurrentVersion\explorer\Browser Helper Objects\{CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1}
HKEY_LOCAL_MACHINE\Software\Classes
\CLSID\{CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1}
HKEY_LOCAL_MACHINE\Software
\Classes\Interface\
{C6906A23-4717-4E1F-F06EBED14177}
HKEY_LOCAL_MACHINE\Software
\Classes\Apuc.UrlCatcher.1
HKEY_LOCAL_MACHINE\Software
\Classes\Apuc.UrlCatcher
Other applications usually install Adware BargainBuddy. This adware consists of two components:
One executable adware file, which downloads advertisements from a server and then displays them.
One dynamic link library (.dll) spyware file, which is a browser helper object that will monitor Internet use on the computer.
We do not know whether the spyware sends Internet usage statistics to the server or downloads advertisements, as certain keywords are typed inside Internet Explorer.
At the time, the server used for downloading advertisements is adp.ikena.com, on port 80. The files themselves do not indicate the name of the company that created this adware application. However, the domain name ikena.com is registered to a company named "eXact advertising."
Try to uninstall BargainBuddy using your Add/Remove Programs utility.
*Make sure you run a full system spyware scan and delete all the spyware files detected as Adware under the file name(s) BargainBuddy.
Delete the spyware value that was added to the registry Run key.
Uninstalling the Adware
Do one of the following:On the Windows 98 taskbar:
Click Start > Settings > Control Panel.
In the Control Panel window, double-click Add/Remove Programs.
On the Windows Me taskbar:
Click Start > Settings > Control Panel.
In the Control Panel window, double-click Add/Remove Programs.
If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."
On the Windows 2000 taskbar:
By default, Windows 2000 is set up the same as Windows 98. In that case, follow the Windows 98 instructions. Otherwise, click Start, point to Settings, point to Control Panel, and then click Add/Remove Programs.
On the Windows XP taskbar:
Click Start > Control Panel.
In the Control Panel window, double-click Add or Remove Programs.
Click Bargain Buddy.
Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.
Scanning for and Deleting the Spyware files
Run your free Spyware Scanner and make sure that it is configured to scan all files.Run a full system spyware scan.
If any files are detected as spyware infected with the Adware BargainBuddy, click Delete. If your spyware scanner reports that it cannot delete the file, use Windows Explorer to navigate to the folder containing the file, and then try to manually delete it.
Deleting the Spyware Values from the Registry
Click Start, and then click Run. (The Run dialog box appears.)Type regedit
Then click OK. (The Registry Editor opens.)
Navigate to the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
\Windows\CurrentVersion\Run
In the right pane, delete the value:
"Bargains"="C:\Program Files\ Bargain Buddy\bin\bargains.exe"
Exit the Registry Editor.
You will find much more on this topic at WorldsLargestNetwork.com
 |
|
|
|
|
WorldsLargestNetwork.com
