Adware.BargainBuddy found in ATI Catalyst Bundle

  • Thread starter Thread starter Harry
  • Start date Start date
H

Harry

Hi there,

Over the past few weeks I have downloaded the ATI Control panel and
Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
just completed. I have sucecssfully installed Catalyst 4.12 and teh
drivers apear to b erunning very well in the new PC.

However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.

Has anyone else detected this, and is BargainBuddy something to be
worried about.

Thanks.
 
Harry said:
Hi there,

Over the past few weeks I have downloaded the ATI Control panel and
Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
just completed. I have sucecssfully installed Catalyst 4.12 and teh
drivers apear to b erunning very well in the new PC.

However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.

Has anyone else detected this, and is BargainBuddy something to be
worried about.
Click to expand...

Given the age of Catalyst 4.12 if there was a problem then one suspects it
would have been noticed by now. Antivirus programs often come up with
false positives. Does a different antivirus come up with the same result?
 
Harry said:
However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.
Click to expand...

Yup,me too.
I use System Works 2005 Premium and when I ran a full system scan with
Norton it tolde me that the 5.2 package had Adware.bargain buddy.
But when I extracted the files to a folder I didn't show anything.
Weird...
--

Glitches are BAD!!!
Beware...

ICQ:275699535
 
Hi there,

Over the past few weeks I have downloaded the ATI Control panel and
Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
just completed. I have sucecssfully installed Catalyst 4.12 and teh
drivers apear to b erunning very well in the new PC.

However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.

Has anyone else detected this, and is BargainBuddy something to be
worried about.

Thanks.
Click to expand...

It's either a false positive, or you downloaded an infected driver set
from a third party site.

BargainBuddy is one of the names for a browser hijacker (it has
several aliasses). When installed, it would redirect internet
explorer to their portal site no matter what you have set as your
browser homepage. Later versions seem to affect mozilla as well. All
versions are a major pain in the ass to get rid of. They name their
files to look like system files, and even place them in the system32
directory to make users reluctant to delete them. They also modify
the registry in at least two places to perform a check at bootup so
that if you DO delete it, it will re-install it using files hidden
elsewhere on the system (location varies by version). Most of the
automated ad removers like Adaware and the newer versions of Norton
don't do a particularly good job of removing it. While I'm sure they
do remove it, the re-install crap kicks in almost immediately on the
next reboot. Sometimes you have to do a manual removal with careful
checking of the run entries in the registry to catch all of it.
Careful both to find all the entries, *AND* careful not to delete
something important.
 
Not all virus scans are legit. It's best to try another scanner. You can
only have one installed at a time though in most cases.

If I use one of the freeware web based scans I get a positive hit on my
installed freeware scanner as it shows up as a Trojan.

Take any scan with a grain of salt.
 
Harry said:
Hi there,

Over the past few weeks I have downloaded the ATI Control panel and
Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
just completed. I have sucecssfully installed Catalyst 4.12 and teh
drivers apear to b erunning very well in the new PC.

However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.

Has anyone else detected this, and is BargainBuddy something to be
worried about.
Click to expand...

BargainBuddy is spyware, not a virus. Neither SpyBot S&D nor Microsoft
AntiSpyware detect anything in the ATI package here. Sounds to me like
a false positive from Norton, which is not unusual for them... NAV has
been known to false on several legitimate files in the past.

Personally, I don't infect my machines with anything by Symantec - it's
all overbloated, buggy, intertwines itself far too deeply into the
system, and in my experience causes more problems that it's ever solved.
 
MCheu said:
It's either a false positive, or you downloaded an infected driver set
from a third party site.

BargainBuddy is one of the names for a browser hijacker (it has
several aliasses). When installed, it would redirect internet
explorer to their portal site no matter what you have set as your
browser homepage. Later versions seem to affect mozilla as well. All
versions are a major pain in the ass to get rid of. They name their
files to look like system files, and even place them in the system32
directory to make users reluctant to delete them. They also modify
the registry in at least two places to perform a check at bootup so
that if you DO delete it, it will re-install it using files hidden
elsewhere on the system (location varies by version). Most of the
automated ad removers like Adaware and the newer versions of Norton
don't do a particularly good job of removing it. While I'm sure they
do remove it, the re-install crap kicks in almost immediately on the
next reboot. Sometimes you have to do a manual removal with careful
checking of the run entries in the registry to catch all of it.
Careful both to find all the entries, *AND* careful not to delete
something important.
---------------------------------------------
Click to expand...

Something like this, try a utility like SpyBot S&D or Microsoft
AntiSpyware, that checks system and user startup locations (both
registry and Startup folders), AND lets you view them and disable
entries manually (rather than deleting them outright, just in case),
which is a lot easier and safer than poking around in RegEdit.
 
Hi there,

Over the past few weeks I have downloaded the ATI Control panel and
Drivers bundles for Catalyst 4.12 and 5.2 for a computer build I have
just completed. I have sucecssfully installed Catalyst 4.12 and teh
drivers apear to b erunning very well in the new PC.

However, I use Norton Internet Security 2005 and after downloadng the
latest virus definitions today, Norton tells me that the 4.12 control
panel and bundle files as well as the 5.2 bundle are 'at risk' from
'Adware.BargainBuddy'.

Has anyone else detected this, and is BargainBuddy something to be
worried about.

Thanks.
Click to expand...

There is something wrong with Norton shitware. I was in the anti
spyware group and someone made a post that Norton found the same
Bargainbuddy in ccleaner.exe (Crapcleaner). Crap Cleaner doesn't
contain Bargainbudy so it is a false positive reading and I expect
that's what Norton shitware is showing you too.
 
Personally, I don't infect my machines with anything by Symantec - it's
all overbloated, buggy, intertwines itself far too deeply into the
system, and in my experience causes more problems that it's ever solved.
Click to expand...

I agree. It's a false positive. See my other post about Norton
flagging Crap Cleaner with the same Bargainbuddy spyware when in fact
it doesn't contain it.
 
Back
Top