PC Hell: Bargain Buddy Removal Instructions

Bargain Buddy AKA Cashback by Bargain Buddy is a piece of adware that allows you to receive a rebate on purchases from participating merchants. Relevant ads are displayed as popups by the Bullseye Network portion of the software while it has a BHO (browser hijacker object) component to handle 404 errors in the form of a web site called Navisearch. All of these products are part of the Bargain Buddy package run by eXact Advertising.

You'll notice the followingicon in the System Tray if Bargain Buddy is installed on your computer.

You may also see the following Navisearch 404 page if you search for a web page that doesnt exist.

If you run Hijackthis, you'll also notice the following lines that have been added:

O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll

O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe

First, uninstall the Bullseye Network, Cashback by Bargain Buddy, and Navisearch from Add/Remove Programs

3) Select the Bullseye Network and click Add/Remove. During the uninstall you are required to fill out a survey asking why you uninstalled the product also be careful in answering the Yes/No questions during the uninstall since they are worded in such a way as to make you keep the product.

During the uninstall process, you will be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.

6) Unfortunately, even after removing the above items with Add/Remove Programs, the Bullseye Network and other files remain. For this reason, I would advise everyone to download and run Spybot Search and Destroy and run it to remove the leftover files shown below:

eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\nvms.dll
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\exul.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\exdl.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\SYSTEM32\bbchk.exe
eXact Advertising.BargainsBuddy: Executable (File, nothing done)
C:\WINDOWS\bbchk.exe
eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\mscb.dll
eXact Advertising.BargainsBuddy: Library (File, nothing done)
C:\WINDOWS\SYSTEM32\msbe.dll

eXact Advertising.BargainsBuddy: Autorun settings (BullsEye Network) (Registry value,nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BullsEye Network

eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE188402-6EE7-4022-8868-AB25173A3E14}
eXact Advertising.BargainsBuddy: Browser helper object (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}

eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344}
eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{CE188402-6EE7-4022-8868-AB25173A3E14}
eXact Advertising.BargainsBuddy: Class ID (Registry key, nothing done)
HKEY_CLASSES_ROOT\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}
eXact Advertising.BargainsBuddy: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{C6906A23-4717-4E1F-B6FD-F06EBED15678}
eXact Advertising.BargainsBuddy: Interface (Registry key, nothing done)
HKEY_CLASSES_ROOT\Interface\{8EEE58D5-130E-4CBD-9C83-35A0564E5678}

eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\NLS.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\NLS.UrlCatcher
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\CB.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\CB.UrlCatcher
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\ADP.UrlCatcher.1
eXact Advertising.BargainsBuddy: Root class (Registry key, nothing done)
HKEY_CLASSES_ROOT\ADP.UrlCatcher

eXact Advertising.BargainsBuddy: Settings (Registry key, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\eXactUtil

eXact Advertising.BargainsBuddy: Type library (Registry key, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{4EB7BBE8-2E15-424B-9DDB-2CDB9516B2C3}

7) After removing these leftover files with Spybot Search and Destroy, Bargain Buddy, the Bullseye Network, and Navisearch should now be completely removed from your computer.