Adware.SaveNow.FN (file analysis)

The Adware.SaveNow.FN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware.SaveNow.FN virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Installs itself for autorun at Windows startup

Related domains:

app.memedia.com

downloads.memedia.com

How to determine Adware.SaveNow.FN?


File Info:
crc32: 667FE924
md5: 3f9d4332457bd81411bb853b1b6169a2
name: seagsetup.exe
sha1: ac2b300d3bd01f6cce42ae3e461473ea9ff5787a
sha256: dad3d8148034412429c01ff8df351e61e266b4f622d39db7d596667d04ce8ba6
sha512: 8aefb752ba14c92895deff4690550aeffab61b75450a8b0ebfec78ed7fe4c1b3b6db855e9073b97c361037945b2242153ab4ceef2a08a4cc164a7514a2f28274
ssdeep: 49152:L6d8aaaRjWETa7yoCtAKKQs/16LeOg/dVbv4F:ud/aaR6EO7f/ECj1VbC
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2006 MyPlayCity.com                                                                     
FileDescription: Sea Guard Setup                                             
FileVersion:                     
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: MyPlayCity.com                                              
Translation: 0x0409 0x04e4

Adware.SaveNow.FN also known as:

Bkav	W32.HfsAdware.33F8
MicroWorld-eScan	Adware.SaveNow.FN
FireEye	Adware.SaveNow.FN
CAT-QuickHeal	Trojan.SaveNow
Cylance	Unsafe
VIPRE	WhenU
K7AntiVirus	Adware ( 004b87fd1 )
BitDefender	Adware.SaveNow.FN
K7GW	Adware ( 004b87fd1 )
Cybereason	malicious.2457bd
Cyren	W32/Adware.HVZY-4124
Avast	Win32:Whenu-H [PUP]
GData	Adware.SaveNow.FN
NANO-Antivirus	Trojan.Win32.SaveNow.behwl
Rising	Trojan.Win32.Generic.13FAB86D (C64:YzY0OkISgkOwxfhe)
Sophos	AdVantage (PUA)
Comodo	Malware@#17gj5lr00lyxi
F-Secure	Adware.ADWARE/SaveNow.FN
DrWeb	Adware.SaveNow.214
Emsisoft	Adware.SaveNow.FN (B)
Ikarus	AdWare.Win32.Advantage
F-Prot	W32/Adware.AFJN
Avira	ADWARE/SaveNow.FN
MAX	malware (ai score=87)
Arcabit	Adware.SaveNow.FN
Microsoft	PUA:Win32/Conduit
Malwarebytes	PUP.Optional.MyPlayCity
ESET-NOD32	Win32/Adware.WhenU.SaveNow potentially unwanted
Yandex	Adware.Advantage!wbSXQOepYiY
Fortinet	W32/AdVantage.SAVENOW
AVG	Win32:Whenu-H [PUP]

How to remove Adware.SaveNow.FN?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Adware.SaveNow.FN (file analysis)