Jump to content

Removal instructions for SavingsDownloader


Recommended Posts

  • Staff

What is SavingsDownloader?

 

The Malwarebytes research team has determined that SavingsDownloader is adware. These adware applications display advertisements not originating from the sites you are browsing.

 

How do I know if my computer is affected by SavingsDownloader?

 

You may see this entry in your list of installed programs:

 

warning4.png

How did SavingsDownloader get on my computer?

 

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

 

How do I remove SavingsDownloader?

 

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.

  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of SavingsDownloader?
  • No, Malwarebytes' Anti-Malware removes SavingsDownloader completely.
How would the full version of Malwarebytes Anti-Malware help protect me?

 

We hope our application and this guide have helped you eradicate this hijacker.  

 

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the SavingsDownloader adware.  It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

 

protection1.png

Technical details for experts

 

You will see these signs in a HijackThis log:

O23 - Service: SavingsDownloaderService - Unknown owner - C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ajfhqofhwu.exe
 

 

Alterations made by the installer:

File system details  ---------------------------------------------    Adds the folder C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC       Adds the file 64.ico"="10/10/2014 9:32 PM, 32038 bytes, A       Adds the file ajfhqofhwu.exe"="10/10/2014 9:32 PM, 151040 bytes, A       Adds the file libeay32.dll"="10/10/2014 9:32 PM, 1265664 bytes, A       Adds the file nfapi.dll"="10/10/2014 9:32 PM, 102400 bytes, A       Adds the file nfregdrv.exe"="10/10/2014 9:32 PM, 49152 bytes, A       Adds the file ProtocolFilters.dll"="10/10/2014 9:32 PM, 323584 bytes, A       Adds the file ssleay32.dll"="10/10/2014 9:32 PM, 348160 bytes, A       Adds the file uninstall_a.exe"="10/31/2014 1:50 PM, 55131 bytes, A    Adds the folder C:\Program Files\SavingsDownloader\SSL    In the existing folder C:\Windows\System32\drivers       Adds the file netfilter.sys"="10/10/2014 9:32 PM, 31744 bytes, A       Adds the file updater_ajfhqofhwu.exe"="10/10/2014 9:32 PM, 483328 bytes, ARegistry details  ------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\savingsdownloader]       "DisplayIcon"="REG_SZ", ""C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\64.ico""       "DisplayName"="REG_SZ", "savingsdownloader"       "EstimatedSize"="REG_DWORD", 1837       "InstallLocation"="REG_SZ", ""C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC""       "NoModify"="REG_DWORD", 1       "NoRepair"="REG_DWORD", 1       "Publisher"="REG_SZ", "savingsdownloader"       "QuietUninstallString"="REG_SZ", ""C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\uninstall_a.exe" /S"       "UninstallString"="REG_SZ", ""C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\uninstall_a.exe""    [HKEY_LOCAL_MACHINE\SOFTWARE\savingsdownloader]       "(Default)"="REG_SZ", ""       "key"="REG_SZ", "B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC"       "qual"="REG_SZ", "CECB17D2-5C89-475E-BC20-AAF9B0068385"    [HKEY_LOCAL_MACHINE\SOFTWARE\savingsdownloader\savingsdownloader]       "(Default)"="REG_SZ", ""       "INSTALLNETFILTERSTATUS"="REG_SZ", "TRUE"       "P"="REG_SZ", "http://d.khb09w.com/xuiow/"       "S"="REG_SZ", "B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC"       "STATUSCODE"="REG_SZ", "3"       "T"="REG_SZ", "1414759831"       "U"="REG_SZ", "CECB17D2-5C89-475E-BC20-AAF9B0068385"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\netfilter]       "DisplayName"="REG_SZ", "netfilter"       "ErrorControl"="REG_DWORD", 1       "Group"="REG_SZ", "PNP_TDI"       "ImagePath"="REG_EXPAND_SZ, "system32\drivers\netfilter.sys"       "Start"="REG_DWORD", 1       "Tag"="REG_DWORD", 9       "Type"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\netfilter\Enum]       "0"="REG_SZ", "Root\LEGACY_NETFILTER\0000"       "Count"="REG_DWORD", 1       "NextInstance"="REG_DWORD", 1    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SavingsDownloaderService]       "DisplayName"="REG_SZ", "SavingsDownloaderService"       "ErrorControl"="REG_DWORD", 1       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ajfhqofhwu.exe"       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16    [HKEY_CURRENT_USER\Software\AppDataLow\Software\savingsdownloader]       "key"="REG_SZ", "B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC"
Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 10/31/2014Scan Time: 1:39:44 PMLogfile: mbamDownloadSavings.txtAdministrator: YesVersion: 2.00.3.1025Malware Database: v2014.10.31.04Rootkit Database: v2014.10.22.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 272978Time Elapsed: 3 min, 16 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 1PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ajfhqofhwu.exe, 6444, Delete-on-Reboot, [e060b8636e0e7db950076dbca560af51]Modules: 4PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\libeay32.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\nfapi.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ProtocolFilters.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ssleay32.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], Registry Keys: 4PUP.Optional.SavingsDownloader.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SavingsDownloaderService, Quarantined, [e060b8636e0e7db950076dbca560af51], PUP.Optional.SavingsDownloader.A, HKLM\SOFTWARE\savingsdownloader, Quarantined, [4af6f6256b11f83ea3564855b64ee719], PUP.Optional.SavingsDownloader.A, HKCU\SOFTWARE\APPDATALOW\SOFTWARE\savingsdownloader, Quarantined, [2b15cc4f1c606fc732c95c41ec18f20e], PUP.Optional.SavingsDownloader.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\savingsdownloader, Quarantined, [4ef248d3f3896dc9a7f6cd5725de2ed2], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 3PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\SavingsDownloader, Quarantined, [69d7e03b3d3fae88b0eef23247bcab55], PUP.Optional.SavingsDownloader.A, C:\Program Files\SavingsDownloader\SSL, Quarantined, [69d7e03b3d3fae88b0eef23247bcab55], Files: 10PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ajfhqofhwu.exe, Delete-on-Reboot, [e060b8636e0e7db950076dbca560af51], PUP.Optional.SavingsDownloader.A, C:\Users\{username}\Desktop\Downloadsavings.exe, Quarantined, [53edc7544834e74f292ecf5a0cf920e0], PUP.Optional.AdPeak.A, C:\Windows\System32\drivers\updater_ajfhqofhwu.exe, Quarantined, [0e3274a73f3dea4c1cea5c4ca55de020], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\64.ico, Quarantined, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\libeay32.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\nfapi.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\nfregdrv.exe, Quarantined, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ProtocolFilters.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\ssleay32.dll, Delete-on-Reboot, [4ef248d3f3896dc9a7f6cd5725de2ed2], PUP.Optional.SavingsDownloader.A, C:\Program Files\B9CBF423-6A69-410E-AEC2-C3E1DDDEEFFC\uninstall_a.exe, Quarantined, [4ef248d3f3896dc9a7f6cd5725de2ed2], Physical Sectors: 0(No malicious items detected)(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
Link to post
Share on other sites
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.