Bargain Buddy

purplemtn · 2002/05/23

I got this message when I went to a site " "Warning!
Your browser appears to have the "BargainBuddy" parasite installed. This software can present you with unwanted advertising and compromise your computer's security, and may invade your on-line privacy. It might have been installed without your knowledge.
Information and removal instructions.Here

What I would like to know is where do I type in The command "
"%WinDir%\SYSTEM\regsvr32.exe" /u "C:\Program Files\Net2Phone CommCenter\CC_Versn.dll" " ??

Manual removal [ please see above link for more detailes]
Before you can delete it, the DLL file must be deregistered. In newer versions, this DLL is inside the net2phone folder in 'Program Files'. Here there will be one or more 'bin' folders, one of which will contain a file called 'CC_Versn.dll', and it's inside the 'Net2Phone CommCenter' folder in Program Files.

The command to get rid of it would be (for Win95/98/Me):
"%WinDir%\SYSTEM\regsvr32.exe" /u "C:\Program Files\Net2Phone CommCenter\CC_Versn.dll"

Thank You......purplemtn.....

Zephyr · 2002/05/23

Go to START > RUN and type command.com and press enter.
Then type the command at the prompt you will get. You will need to replace the %xx% with the path to your files, eg., C:\Windows

Good luck.
ps, Be sure you include the quotation marks as indicated. That's always necessary when there is an embedded space in a command or it exceeds the 8 x 3 configuration.

purplemtn · 2002/05/24

Mr

Zephyr
That did the trick ,, Still won't let me delete the dill , but I'm not worried about it
removed every thing from the reg so it should all be gone..
PS ..I don't get the Warning any more..
Thanks..
purplemtn

Zephyr · 2002/05/24

You should be able to delete it if it unregistered ok. Better try it again. Be sure to type it correctly:

"C:\Windows\SYSTEM\regsvr32.exe" /u "C:\Program Files\Net2Phone CommCenter\CC_Versn.dll "

should do it.

Zephyr · 2002/05/24

If it gives you any argument, just boot to a dos session and delete it there.

purplemtn · 2002/05/24

Zephyr

Reran it and was able to delete the dll , both times it said it UnRegitered the dll. Maybe because I had not closed the net2phone folder the 1st time ,but had closed it the 2nd time.

thanks again for your help...
purplemtn

xane · 2002/05/28

You can always use Ad-aware ( http://www.lavasoft.nu ) to remove spyware, it does a good clean up job of it too and it's free.

purplemtn · 2002/05/28

xane

Thanks for the idea ; however...
I was using Ad-aware as well as a trojen cleaner and a anti virus all with the latest updates .. None of them caught this particular program
Thanks again ...purplemtn

dobhar · 2002/05/30

Stupid question but for Ad-aware...did you have the latest version 5.82 and the latest Reference file.

Updated referencefile available, date: 29.05.2002

Zephyr · 2002/05/30

We're talking about a Parasite that is embedded in a program that has been intentionally downloaded. AdAware can't help you there since it doesn't check anything but your cookies.

Here's a good page for reference about the various beasts lurking out there.

http://www.cexx.org/adware.htm

If you read far enough there you'll notice that findfast.exe, which is part of MsWord, is considered a parasite as well.

Regards.

dobhar · 2002/05/30

Thanks, Zephyr...

The more I hang around here the more I'm learning. I actually have this site on my links page but never got around to checking out the whole site. Leason learned.

Laters,

brett · 2002/05/30

A word of caution: I'd just that you tread carefully when following any such instructions delivered by a site unless you implicity trust that site.

The message you received was generated via this script:-

// parasite.js: detect and warn about infestations of IE parasites
// release 1.4, 08-Jan-2001
// written by Andrew Clover <and@doxdesk.com>, use freely

// parasite_list: currently known parasites. Entries are in the form
// {name, guid, can, may}. 'can' contains a string of known problems
// with the parasite and 'may' suspected ones.

var parasite_list= new Array(
new Array('TopText', '3D7247E8-5DB8-11D4-8A72-0050DA2EE1BE', 'A', 'P'),
new Array('VX2', '00000000-5EB9-11D5-9D45-009027C14662', 'APS', ''),
new Array('FlashTrack', '665ACD90-4541-4836-9FE4-062386BB8F05', 'AP', 'E'),
new Array('SaveNow', 'FEE7FD53-3356-4D4D-8978-2C4AE3A7E109', 'AE', 'PS'),
new Array('BargainBuddy', 'CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1', 'AS', 'P'),
new Array('webHancer', 'C900B400-CDFE-11D3-976A-00E02913A9E0', 'P', 'S'),
new Array('Onflow', '0CEF79D8-D373-11D3-A7D3-00062962BF17', 'A', 'S'),
new Array('BDE', '51958169-D5E3-11D1-AA42-0000E842E40A', 'A', 'S'),
new Array('CometCursor', '0922EC1A-9EC7-11D3-80B9-00500487BDBA', 'AP', '')
);

// parasite_url: a directory containing <parasite name>.html files with
// more information and removal instructions. Change this if you want to
// provide your own information.

var parasite_url= 'http://and.doxdesk.com/parasite/';

// text generated by the script. Change this for different languages or
// to customise the output for your site, etc.

var parasite_warn= 'Warning!';
var parasite_infest1= 'Your browser appears to have the "';
var parasite_infest2= '" parasite installed';
var parasite_prob1= '. This software ';
var parasite_can= 'can ';
var parasite_may= 'may ';
var parasite_and= ' and ';
var parasite_infestps= '. It might have been installed without your '+
'consent when you downloaded some other software. ';
var parasite_info= 'Information and removal instructions.';

var parasite_prob= new Array();
parasite_prob['A']= 'present you with unwanted advertising';
parasite_prob['P']= 'violate your privacy on-line';
parasite_prob['S']= 'compromise your computer\'s security';
parasite_prob['E']= 'cause stability problems and errors';

// END of user-serviceable parts

function parasite_write() {
var i; var p;
document.writeln('<div id= "parasite" style= "display: none; ">');
for (i= 0; i<parasite_list.length; i++) {
p= parasite_list;
document.writeln(
'<object classid= "clsid:'+p[1]+'" codebase= "view-source:about:blank ">'+
'<img src= "about:blank" id= "parasite-'+p[0]+' ">'+
'</object>'
);
}
document.writeln('</div>');
window.setTimeout(parasite_check, 1000);
}

function parasite_check() {
var i; var p; var h;
var infestations= new Array();
var cans= new Array(); var mays= new Array();
for (i= 0; i<parasite_list.length; i++) {
p= parasite_list;
if (!(document.images['parasite-'+p[0]))
infestations[infestations.length]= p;
}
if (infestations.length==0) return;
h= '<p><strong>'+parasite_warn+'</strong></p>';
for (i= 0; i<infestations.length; i++) {
p= infestations;
h= h+'<p>'+parasite_infest1+p[0]+parasite_infest2;
if (p[2]!='' || p[3]!='')
h= h+parasite_prob1;
if (p[2]!='')
h= h+parasite_can+parasite_probs(p[2]);
if (p[2]!='' && p[3]!='')
h= h+','+parasite_and;
if (p[3]!='')
h= h+parasite_may+parasite_probs(p[3]);
h= h+parasite_infestps;
h= h+'<a href= "'+parasite_url+p[0]+'.html ">'+parasite_info+'</a></p>';
}
document.all['parasite'].innerHTML= h;
document.all['parasite'].style.display= 'block';
}

function parasite_probs(s) {
var i; var r= '';
for (i= 0; i<s.length; i++) {
r= r+parasite_prob[s.charAt(i)];
if (i==s.length-2) r= r+parasite_and;
if (i<s.length-2) r= r+', ';
}
return r;
}

if (window.clientInformation)
if (window.clientInformation.platform=='Win32')
parasite_write();
Click to expand...

It would be extremely easy for any malicious webmaster to amend this script, or the page to which the script points, so as to advise visitors to delete some vital system file.

In this particular instance, everything is above board and the advice is good - but that may not always be the case.

Tread carefully!

Zephyr - Ad-aware is not limited to only cookies.

purplemtn · 2002/05/30

dobhar , Zephyr , brett

Sorry I was out all of yesterday..

dobhar I was useing the latest update of ad ware , and Now have ver 582 [it was not out at the time]

Zephyr Thanks for the Link..

brett Thanks for the warning [ I trust the site I got the warning from ]
sent you a PM..

Thanks all..

Log in or Sign up

Bargain Buddy

purplemtn Inactive Thread Starter

Zephyr Inactive

purplemtn Inactive Thread Starter

Zephyr Inactive

Zephyr Inactive

purplemtn Inactive Thread Starter

xane Inactive

purplemtn Inactive Thread Starter

dobhar Inactive

Zephyr Inactive

dobhar Inactive

brett Inactive Alumni

purplemtn Inactive Thread Starter

Share This Page

Log in or Sign up

Bargain Buddy

purplemtn Inactive Thread Starter

Zephyr Inactive

purplemtn Inactive Thread Starter

Zephyr Inactive

Zephyr Inactive

purplemtn Inactive Thread Starter

xane Inactive

purplemtn Inactive Thread Starter

dobhar Inactive

Zephyr Inactive

dobhar Inactive

brett Inactive Alumni

purplemtn Inactive Thread Starter

Share This Page

Useful Searches