BargainBuddy & Win32 Trojan Agent

  • Thread starter Thread starter Annie Woughman
  • Start date Start date
A

Annie Woughman

Somehow I managed to pick up this two little pieces of crap and I cannot
get rid of them. I found them with LavaSoft's Ad-aware personal edition.
It removes them for about five minutes and then they are back. I am also
running McAfee Security Center and it doesn't see them when I run a system
scan. I have researched several webpages (like pchell.com) that gives big
long lists of files and registry keys to hunt down and eliminate, but my
computer doesn't have any of those. Can anyone point me in the right
direction? TIA
 
From: "Annie Woughman" <[email protected]>

| Somehow I managed to pick up this two little pieces of crap and I cannot
| get rid of them. I found them with LavaSoft's Ad-aware personal edition.
| It removes them for about five minutes and then they are back. I am also
| running McAfee Security Center and it doesn't see them when I run a system
| scan. I have researched several webpages (like pchell.com) that gives big
| long lists of files and registry keys to hunt down and eliminate, but my
| computer doesn't have any of those. Can anyone point me in the right
| direction? TIA
|



If you are using any version of Sun Java that is prior to JRE Version 5.0 update 6,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 6. There are vulnerabilities in them and they are actively being
exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 6 on the PC that they be removed ASAP.

The latest version is Sun Java JRE/JSE Version 5.0 Update 8

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_08


http://www.java.com/en/download/manual.jsp

or

http://java.sun.com/javase/downloads/index.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1

For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
 
Update AdAdaware once again because those two little pieces of crap were
false positives and Lavasoft has corrected their program. Once AA is
up to date, you will not see them.

Heather
 
Heather said:
Update AdAdaware once again because those two little pieces of crap were
false positives and Lavasoft has corrected their program. Once AA is up
to date, you will not see them.

Heather
Click to expand...
Thank you for your response. I was a little suspicious about the items
showing up, because they didn't match any of the descriptions of them I
found when I researched them. However, they weren't showing up on either of
the other two computers we have in the house that have pretty much been used
for same web surfing as the computer that they did show up on. That did
make me a little nervous.
 
If you are using any version of Sun Java that is prior to JRE Version 5.0
update 6,
then you are strongly urged to remove any/all versions that are prior to
JRE/JSE
Version 5.0 update 6. There are vulnerabilities in them and they are
actively being
exploited.

Therefore, it is highly suggested that if there are any prior versions of
Sun Java
to Version 6 on the PC that they be removed ASAP.

The latest version is Sun Java JRE/JSE Version 5.0 Update 8

Simple check, look under...
C:\Program Files\Java
Click to expand...

Thank you for your response. I wasn't aware of the problem with Java, but I
certainly checked versions on all of my computers and updated them to avoid
any problems in the future.

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_08


http://www.java.com/en/download/manual.jsp

or

http://java.sun.com/javase/downloads/index.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1

For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/
http://www.lavasoft.de/ms/index.htm

* SpyBot Search and Destroy v1.4
http://security.kolla.de/
http://www.safer-networking.org/microsoft.en.html

* SuperAntiSpyware
http://www.superantispyware.com/superantispywarefreevspro.html

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any
Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to
go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in
Normal Mode.
This way all the components can be downloaded from each AV vendor's web
site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
Reboot the PC.

You can choose to go to each menu item and just download the needed files
or you can
download the files and perform a scan in Normal Mode. Once you have
downloaded the files
needed for each scanner you want to use, you should reboot the PC into
Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want
to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal
Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
Click to expand...
 
Annie Woughman said:
Thank you for your response. I was a little suspicious about the
items showing up, because they didn't match any of the descriptions of
them I found when I researched them. However, they weren't showing up
on either of the other two computers we have in the house that have
pretty much been used for same web surfing as the computer that they
did show up on. That did make me a little nervous.
Click to expand...
I got them myself when I updated and after I ran an AV scan, I realized
they HAD to be false alerts. I checked it out right away and then
waited for Lavasoft to sort it out.

Strange that the other 2 computers didn't report them.....was it the
same version of AdAware?? And were they all XP?? Just curious.

Cheers.....Heather
 
Heather said:
I got them myself when I updated and after I ran an AV scan, I realized
they HAD to be false alerts. I checked it out right away and then waited
for Lavasoft to sort it out.

Strange that the other 2 computers didn't report them.....was it the same
version of AdAware?? And were they all XP?? Just curious.

Cheers.....Heather
Click to expand...

Yes, all XP computers and the same version of AdAware with the same update
file. One of the other computers is the exact same computer model as this
one and running McAfee also. The third computer is a different, older
computer and running F-Secure Security Suite. Dunno why this computer was
the only one that ended up with it.
 
Back
Top