Runboard.com
You're welcome.







runboard.com       Sign up (learn about it) | Sign in (lost password?)

 
Wizard27 Profile
Live feed
Blog
Friends
Miscellaneous info



Registered: 10-2006
Posts: 122
Karma: 0 (+0/-0)
reply | quote
How to remove Bargain Buddy


What is Bargain Buddy?
Bargain Buddy AKA Cashback by Bargain Buddy is a piece of adware that allows you to receive a rebate on purchases from participating merchants.

Relevant ads are displayed as popups by the Bullseye Network portion of the software while it has a BHO (browser hijacker object) component to handle 404 errors in the form of a web site called Navisearch.

All of these products are part of the Bargain Buddy package run by eXact Advertising.

How to tell if you have Bargain Buddy Installed on your computer

You'll notice the icon of a dog in the System Tray if Bargain Buddy is installed on your computer.

You may also see a Navisearch 404 page if you search for a web page that doesnt exist too.

If you run Hijackthis, you'll also notice the following lines that have been added:

O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll

O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe


Removing Bargain Buddy

First, uninstall the Bullseye Network, Cashback by Bargain Buddy, and Navisearch from Add/Remove Programs

1) Click on Start, Settings, Control Panel

2) Choose Add/Remove Programs

3) Select the Bullseye Network and click Add/Remove. During the uninstall you are required to fill out a survey asking why you uninstalled the product also be careful in answering the Yes/No questions during the uninstall since they are worded in such a way as to make you keep the product

4) Select Cashback by BargainBuddy and click Add/Remove

5) Select Navisearch and Click Add/Remove

During the uninstall process, you will be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.

6) Unfortunately, even after removing the above items with Add/Remove Programs, the Bullseye Network and other files remain. For this reason, I would advise you to download and run Spybot Search and Destroy or Ad-Aware SE Personal Edition and run it to remove the leftover files shown below:

eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\nvms.dll
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\exul.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\exdl.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\bbchk.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\bbchk.exe
eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\mscb.dll
eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\msbe.dll

eXact Advertising.BargainsBuddy: Autorun settings (BullsEye Network) (Registry value,nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BullsEye Network

eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE188402-6EE7-4022-8868-AB25173A3E14}
eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}

eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{CE188402-6EE7-4022-8868-AB25173A3E14}
eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
eXact Advertising.BargainsBuddy: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED15678}
eXact Advertising.BargainsBuddy: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E5678}

eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\NLS.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\NLS.UrlCatcher
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\CB.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\CB.UrlCatcher
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\ADP.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\ADP.UrlCatcher

eXact Advertising.BargainsBuddy: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\eXactUtil

eXact Advertising.BargainsBuddy: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516B2C3}

7) After removing these leftover files with Spybot Search and Destroy or Ad-Aware SE Personal Edition, Bargain Buddy, the Bullseye Network, and Navisearch should now be completely removed from your computer

---

16/11/06, 23:17 Link to this Post Send an Email to this person   Send a PM to this person
 


Add A Reply





You are not logged in (login)
--> The Runboard Web-Ring <--
Previous | Home | Join | Random | Next