ibis toolbar and BargainBuddy removal

[noby44]

Hello,
after cleaning a system from malware, i am left with IBIS Toolbar and BargainBuddy which seemingly are removed by adaware, but keep coming back.
I have run :adaware, spybot, cwshredder, housecall, ravantivirus.

does somebody know how to remove these pests?

Thanks in advance

noby44

 

[carrr]

Have you disabled system restore?

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[noby44]

yes, system restore is disabled; i must add i also ran Hijackthis, and searched the registry for IBIS and BargainBuddy, but no references were found

Thanks for the quick reply though !

 

[starzwell]

***That is one pesky devil to get rid of here's what I have on it.

Some versions can be removed from the Add/Remove Programs option in the Control Panel. This option seems to be missing in the newer Net2Phone version. Try this:

Exit Bargain Buddy from your Tray Bar, if it is present.
Press CTRL + ALT + DEL to remove Bargain Buddy from your task manager (if it is present).
Proceed to Start -> Control Panel -> Add / Remove Programs, and remove Bargain Buddy.
If the uninstall for Bargain Buddy isn't present in the Add / Remove Programs Window, the Uninstaller may be listed in your Program Files (accessible from the Start Menu).
To remove it manually:

1) Unregister the DLL file first.

In BargainBuddy/Apuc, this DLL is inside the Bargain Buddy folder in 'Program Files'. Here there will be one or more 'bin' folders, one of which will contain a file called apuc.dll. If, for example, it's in 'bin2', the commands to enter (from a DOS command prompt window, under Start->Programs->Accessories) would be:

cd "%WinDir%\System"
regsvr32 /u "\Program Files\Bargain Buddy\bin2\apuc.dll"

Note:%WinDir% is a variable, you should replace it with the windows directory on your system, by default, it is named c:\windows or c:\winnt .

In BargainBuddy/Version, the file you have to get rid of is instead called 'CC_Versn.dll', and it's inside the 'Net2Phone CommCenter' folder in Program Files. The commands to get rid of it are:

cd "%WinDir%\System"
regsvr32 /u "\Program Files\Net2Phone CommCenter\CC_Versn.dll".

2) Open Task Manager (ctrl-alt-delete), end the 'Bargains' process.

3) Delete the entire 'Bargain Buddy' folder.

4) Run the registry editor(Click Start > Run and type ' Regedit').

5) Locate and expand the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, find and delete the Bargain Buddy entry.

6) Find and delete the key HKEY_LOCAL_MACHINE\Software\Bargains; in the Adp variant this is HKEY_LOCAL_MACHINE\Software\Microsoft\adp instead.





Steph

Get the Fox...

http://www.mozilla.com

 

[noby44]

Thanks steph, but those references do not exist on my system; that is what makes it so tough, is'n t'it

 

[defreib]

I had the same problem month's ago. Try going to this site. It is specific directions for removal.

http://www.pchell.com/support/bargainbuddy.shtml

or

http://www.spyany.com/program/article_spy_rm_BargainBuddy.html

 

[noby44]

defreib, i just tried the bargainbuddy solution from PCHELL, but those references did not exist on my system, and when the keys existed, they could not be deleted.

I will look into your other link now

 

[noby44]

And too bad, the other one i tried already too, with the same result. My Hijack this file is healthy too. So please, let the ideas come !

 

[eyec]

i had this on one of my kid's machines. it took me forever to get rid of but from what i remember it was bundled with another packages that stuck entries into the registry. it was those entries i had to get rid of to completley clean the machine.

i will try to see if i can find my notes or remember the "other" package it was in with and let you know.

 

[defreib]

Does it only pop up when using IE?

 

[noby44]

no it does not pop up, but when i scan with adaware, even after removal, it is back

 

[defreib]

have you tried this one?

http://www.paretologic.com/xoftspy/lp/14/

 

[diogenes10]

If dll files are an issue, there was a program around called dllcompare. However the broadbandmedic site is down and it is no longer listed in the Subratam downloads page so I do not know where to get it and if it is still considered to be a useful tool.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[noby44]

i have found some registry keys (wintools) that cannot be deleted, even in safe mode and logged on as admin, and taken full permissions on the key, it says error : cannot delete this key, an error occurred; other keys delete without problems