My Safe Savings

[Asfi]

Okay, so I have this one stupid virus on my computer called My Safe Savings. NO SCANNERS ARE DETECTING IT. Basically what it does is open malicious links on Internet Explorer like those "CALL THIS NUMBER YOU GOT A VIRUS" websites. It gets SO ANNOYING when I'm trying to game and those just pop up. I've tried everything. AdwCleaner, Combofix, Malwarebytes, Avast, Vipre, deleting folder after killing the process, Revo Uninstaller, EVERYTHING. There isn't a registry key as far as I can tell but nothing is working. When I kill it in task manager, it says its gone for a few seconds so I try to delete the folder but it still tells me it's open. I really want to just wipe my computer but I don't have a Windows 7 install disc since the OS came preinstalled on my PC. I can't get an ISO on a flashdrive either because Microsoft won't let me download it since my computer came preinstalled with Windows. It's an HP Elite Pavilion 210-y and I've gone to HP for support but the program that's supposed to restore my computer to it's factory condition isn't there and there is no way to install it. Please, someone help me. I've been pulling my hair out over this for weeks. None of those removal guides on Google work and I seriously just don't know what to do.

[Asfi]

No one?

[David H. Lipman]

There is no such virus called My Safe Savings.  That's a misinterpretation. 

Web sites that display "CALL THIS NUMBER YOU GOT A VIRUS" are frauds and do not require software to be on the PC.  They are a type of malvertisement.  They can be mixed into a rotating advertisement on a web site or mixed into a randomized advertisement.  Some web sites are more prone to this than others.  It is dependent on whom the web site owner chooses to do advertisement business with.  Over a ~3 month period Newegg had this problem.  All you had to do was continuously refresh the web page and eventually the malvertisment was displayed.  In their case it was a fake Adobe update.  In this case it is a fake indication of infection.  Another could also be a fake indication of a Blue Screen of Death ( BSoD ) condition.

Since these fraud sites are not dependent upon software to be on a PC, no anti malware software can detect it.  Simply because it emanates from the Web and not from the PC.

Many of those "removal guides" are on the edge of being a fraud themselves.  They aren't there to help you.  They are created such that the web site owner can get affiliate revenue from companies like and hopefully buy it as well.

The following is a video example  http://multi-av.thespykiller.co.uk/other/MallwareScam.wmv

No software on the PC generated that.  It is just a specially crafted web site

What you need to do is identify what web site you visit that is prone to this occurring.  In my example above is was Newegg.  After I identified it to Newegg it stopped.  I find if I visit porn sites there is an increased propensity of getting these fraud site malvertisements.

If you get it, recognize what Browser you are using such as Firefox or Internet Explorer. 

When it occurs and you are in Firefox, hit the key sequence "Ctrl" + "Alt" + "Del".  Then choose "Start Task Manager".  Then find FIREFOX.EXE, highlight it and choose "End Process".

Likewise if you are in Internet Explorer, hit the key sequence "Ctrl" + "Alt" + "Del".  Then choose "Start Task Manager".  Then find IEXPLORE.EXE, highlight all occurrences and choose "End Process" for each and every IEXPLORE.EXE process seen in Task Manger.

When you end the process and that "CALL THIS NUMBER YOU GOT A VIRUS" fraud page disappears you prove that it is not software on your PC it is just a Fraud Malvertisement.

 

[David H. Lipman]

Is there anything else Asfi  ?

 

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!