Adware.BargainBuddy found in ATI Catalyst Bundle

On Wed, 16 Mar 2005 21:24:41 +0000, Harry <harry.TakeThisOut@hmack.demon.co.uk>
wrote:

 >Hi there,
 >
 >Over the past few weeks I have downloaded the ATI Control panel and
 >Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
 >just completed. I have sucecssfully installed Catalyst 4.12 and teh
 >drivers apear to b erunning very well in the new PC.
 >
 >However, I use Norton Internet Security 2005 and after downloadng the
 >latest virus definitions today, Norton tells me that the 4.12 control
 >panel and bundle files as well as the 5.2 bundle are 'at risk' from
 >'Adware.BargainBuddy'.
 >
 >Has anyone else detected this, and is BargainBuddy something to be
 >worried about.
 >
 >Thanks.

It's either a false positive, or you downloaded an infected driver set
from a third party site.

BargainBuddy is one of the names for a browser hijacker (it has
several aliasses). When installed, it would redirect internet
explorer to their portal site no matter what you have set as your
browser homepage. Later versions seem to affect mozilla as well. All
versions are a major pain in the ass to get rid of. They name their
files to look like system files, and even place them in the system32
directory to make users reluctant to delete them. They also modify
the registry in at least two places to perform a check at bootup so
that if you DO delete it, it will re-install it using files hidden
elsewhere on the system (location varies by version). Most of the
automated ad removers like Adaware and the newer versions of Norton
don't do a particularly good job of removing it. While I'm sure they
do remove it, the re-install crap kicks in almost immediately on the
next reboot. Sometimes you have to do a manual removal with careful
checking of the run entries in the registry to catch all of it.
Careful both to find all the entries, *AND* careful not to delete
something important.
---------------------------------------------

MCheu<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

Harry wrote:
 > However, I use Norton Internet Security 2005 and after downloadng the
 > latest virus definitions today, Norton tells me that the 4.12 control
 > panel and bundle files as well as the 5.2 bundle are 'at risk' from
 > 'Adware.BargainBuddy'.
 >

Yup,me too.
I use System Works 2005 Premium and when I ran a full system scan with
Norton it tolde me that the 5.2 package had Adware.bargain buddy.
But when I extracted the files to a folder I didn't show anything.
Weird...
--

Glitches are BAD!!!
Beware...

ICQ:275699535<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

No doubt a Norton glitch. I hate Norton.

DaveL


"Glitch" <Glitch_120 RemoveThis @yahoo.com> wrote in message
news:d1acil$m2b$1@bagan.srce.hr...
 > Harry wrote:
  >> However, I use Norton Internet Security 2005 and after downloadng the
  >> latest virus definitions today, Norton tells me that the 4.12 control
  >> panel and bundle files as well as the 5.2 bundle are 'at risk' from
  >> 'Adware.BargainBuddy'.
  >>
 >
 > Yup,me too.
 > I use System Works 2005 Premium and when I ran a full system scan with
 > Norton it tolde me that the 5.2 package had Adware.bargain buddy.
 > But when I extracted the files to a folder I didn't show anything.
 > Weird...
 > --
 >
 > Glitches are BAD!!!
 > Beware...
 >
 > ICQ:275699535<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

Not all virus scans are legit. It's best to try another scanner. You can
only have one installed at a time though in most cases.

If I use one of the freeware web based scans I get a positive hit on my
installed freeware scanner as it shows up as a Trojan.

Take any scan with a grain of salt.

"Harry" <harry.RemoveThis@hmack.demon.co.uk> wrote in message
news:tl8h319qh2p1i8cl89koubk2l88ug18n62@4ax.com...
 > Hi there,
 >
 > Over the past few weeks I have downloaded the ATI Control panel and
 > Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
 > just completed. I have sucecssfully installed Catalyst 4.12 and teh
 > drivers apear to b erunning very well in the new PC.
 >
 > However, I use Norton Internet Security 2005 and after downloadng the
 > latest virus definitions today, Norton tells me that the 4.12 control
 > panel and bundle files as well as the 5.2 bundle are 'at risk' from
 > 'Adware.BargainBuddy'.
 >
 > Has anyone else detected this, and is BargainBuddy something to be
 > worried about.
 >
 > Thanks.<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

Harry wrote:

 > Hi there,
 >
 > Over the past few weeks I have downloaded the ATI Control panel and
 > Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
 > just completed. I have sucecssfully installed Catalyst 4.12 and teh
 > drivers apear to b erunning very well in the new PC.
 >
 > However, I use Norton Internet Security 2005 and after downloadng the
 > latest virus definitions today, Norton tells me that the 4.12 control
 > panel and bundle files as well as the 5.2 bundle are 'at risk' from
 > 'Adware.BargainBuddy'.
 >
 > Has anyone else detected this, and is BargainBuddy something to be
 > worried about.

BargainBuddy is spyware, not a virus. Neither SpyBot S&D nor Microsoft
AntiSpyware detect anything in the ATI package here. Sounds to me like
a false positive from Norton, which is not unusual for them... NAV has
been known to false on several legitimate files in the past.

Personally, I don't infect my machines with anything by Symantec - it's
all overbloated, buggy, intertwines itself far too deeply into the
system, and in my experience causes more problems that it's ever solved.<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

MCheu wrote:

 > On Wed, 16 Mar 2005 21:24:41 +0000, Harry <harry.DeleteThis@hmack.demon.co.uk>
 > wrote:
 >
 >
  >>Hi there,
  >>
  >>Over the past few weeks I have downloaded the ATI Control panel and
  >>Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
  >>just completed. I have sucecssfully installed Catalyst 4.12 and teh
  >>drivers apear to b erunning very well in the new PC.
  >>
  >>However, I use Norton Internet Security 2005 and after downloadng the
  >>latest virus definitions today, Norton tells me that the 4.12 control
  >>panel and bundle files as well as the 5.2 bundle are 'at risk' from
  >>'Adware.BargainBuddy'.
  >>
  >>Has anyone else detected this, and is BargainBuddy something to be
  >>worried about.
  >>
  >>Thanks.
 >
 >
 > It's either a false positive, or you downloaded an infected driver set
 > from a third party site.
 >
 > BargainBuddy is one of the names for a browser hijacker (it has
 > several aliasses). When installed, it would redirect internet
 > explorer to their portal site no matter what you have set as your
 > browser homepage. Later versions seem to affect mozilla as well. All
 > versions are a major pain in the ass to get rid of. They name their
 > files to look like system files, and even place them in the system32
 > directory to make users reluctant to delete them. They also modify
 > the registry in at least two places to perform a check at bootup so
 > that if you DO delete it, it will re-install it using files hidden
 > elsewhere on the system (location varies by version). Most of the
 > automated ad removers like Adaware and the newer versions of Norton
 > don't do a particularly good job of removing it. While I'm sure they
 > do remove it, the re-install crap kicks in almost immediately on the
 > next reboot. Sometimes you have to do a manual removal with careful
 > checking of the run entries in the registry to catch all of it.
 > Careful both to find all the entries, *AND* careful not to delete
 > something important.
 > ---------------------------------------------

Something like this, try a utility like SpyBot S&D or Microsoft
AntiSpyware, that checks system and user startup locations (both
registry and Startup folders), AND lets you view them and disable
entries manually (rather than deleting them outright, just in case),
which is a lot easier and safer than poking around in RegEdit.<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

On Wed, 16 Mar 2005 21:24:41 +0000, Harry <harry.DeleteThis@hmack.demon.co.uk>
wrote:

 >Hi there,
 >
 >Over the past few weeks I have downloaded the ATI Control panel and
 >Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
 >just completed. I have sucecssfully installed Catalyst 4.12 and teh
 >drivers apear to b erunning very well in the new PC.
 >
 >However, I use Norton Internet Security 2005 and after downloadng the
 >latest virus definitions today, Norton tells me that the 4.12 control
 >panel and bundle files as well as the 5.2 bundle are 'at risk' from
 >'Adware.BargainBuddy'.
 >
 >Has anyone else detected this, and is BargainBuddy something to be
 >worried about.
 >
 >Thanks.

There is something wrong with Norton shitware. I was in the anti
spyware group and someone made a post that Norton found the same
Bargainbuddy in ccleaner.exe (Crapcleaner). Crap Cleaner doesn't
contain Bargainbudy so it is a false positive reading and I expect
that's what Norton shitware is showing you too.<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle 

On Thu, 17 Mar 2005 01:28:44 GMT, Matt Ion <soundy DeleteThis @moltenimage.com>
wrote:


 >Personally, I don't infect my machines with anything by Symantec - it's
 >all overbloated, buggy, intertwines itself far too deeply into the
 >system, and in my experience causes more problems that it's ever solved.

I agree. It's a false positive. See my other post about Norton
flagging Crap Cleaner with the same Bargainbuddy spyware when in fact
it doesn't contain it.<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Adware.BargainBuddy found in ATI Catalyst Bundle