Categories: Adware

Adware:Win32/Safesaver removal guide

The Adware:Win32/Safesaver is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Adware:Win32/Safesaver virus can do?

A file was accessed within the Public folder.
Sample contains Overlay data
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to create or modify a Browser Helper Object
Anomalous binary characteristics
Yara detections observed in process dumps, payloads or dropped files

How to determine Adware:Win32/Safesaver?


File Info:
name: 383D1C22178319878D38.mlwpath: /opt/CAPEv2/storage/binaries/a16bb786862f96c1a9071965f25fbccef68fcccf69dc896e58f076730c3dc02ecrc32: 7E03D802md5: 383d1c22178319878d38db5c7d3af739sha1: 81c49fca6a2f86d1e0914589ec61484db672dd60sha256: a16bb786862f96c1a9071965f25fbccef68fcccf69dc896e58f076730c3dc02esha512: fda358f16d62f6b40bb80af3ed832f70869741fb2f1c65b2e4e37b4a3c484b49b1bdec9fd7c13c0aaa4f5181e9a90f392570d095aad742ce58b1508e3e7b6b3cssdeep: 6144:h1OgDPdkBAFZWjadD4s5jNiLKS1b8XUmYkeB0Rj:h1OgLdaORiLKSd7mYi5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EE44D0213AE0C8FAD6920132CEA46FD5E2F9D7640F30487373D94A2D6F7D984D136A69sha3_384: 1b26de7da399f5de24b6f1163f9594e60d1a5c5d1846d498a6371c9c5f4cafeb47cfc160687f8a165d6ed3547ecf8a50ep_bytes: 558bec6aff68e0b94100682c4a410064timestamp: 2010-11-18 16:27:35
Version Info:
CompanyName: Igor PavlovFileDescription: 7z Setup SFXFileVersion: 9.20InternalName: 7zS.sfxLegalCopyright: Copyright (c) 1999-2010 Igor PavlovOriginalFilename: 7zS.sfx.exeProductName: 7-ZipProductVersion: 9.20Translation: 0x0409 0x04b0

Adware:Win32/Safesaver also known as:

Bkav	W32.AIDetectMalware
DrWeb	JS.Plugin.13
MicroWorld-eScan	Dropped:Adware.JS.MultiPlug.A
FireEye	Dropped:Adware.JS.MultiPlug.A
CAT-QuickHeal	Diplugem.JS.A
Skyhigh	BehavesLike.Win32.Downloader.dc
McAfee	Downloader-FLN
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	AdWare:Script/MultiPlug.6c4e4380
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/grayware_confidence_100% (W)
VirIT	Trojan.Win32.Zyx.SP
Symantec	Adware.Popuppers
Elastic	malicious (high confidence)
ESET-NOD32	multiple detections
APEX	Malicious
TrendMicro-HouseCall	ADW_MULTIPLUG
ClamAV	Js.Adware.Multiplug-2
Kaspersky	not-a-virus:AdWare.Win32.MegaSearch.am
BitDefender	Dropped:Adware.JS.MultiPlug.A
NANO-Antivirus	Riskware.Script.Plugin.cjvvyt
Avast	JS:Browsermodifier-B [Trj]
Tencent	Win32.AdWare.Megasearch.Dflw
Emsisoft	Dropped:Adware.JS.MultiPlug.A (B)
Google	Detected
F-Secure	Malware.JS/MPlug.PR
VIPRE	Dropped:Adware.JS.MultiPlug.A
TrendMicro	ADW_MULTIPLUG
Trapmine	malicious.high.ml.score
Sophos	Generic Reputation PUA (PUA)
Ikarus	PUA.Monetizer.Gen7
Jiangmin	AdWare.MultiPlug.cgtb
Varist	JS/MPlug.A
Avira	ADWARE/Adware.Gen7
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	malware.kb.a.819
Microsoft	Adware:Win32/Safesaver
Xcitium	Application.Win32.Multiplug.D@4rev5n
Arcabit	Adware.JS.MultiPlug.A
ZoneAlarm	not-a-virus:HEUR:AdWare.Script.Generic
GData	Win32.Trojan.Multiplug.E
Cynet	Malicious (score: 100)
VBA32	Adware.MultiPlug
ALYac	Dropped:Adware.JS.MultiPlug.A
Cylance	unsafe
Panda	Trj/CI.A
Rising	Adware.ScrInject!1.CF70 (CLASSIC)
Yandex	PUA.Agent!oLP4FA1o/W4
MAX	malware (ai score=100)
MaxSecure	Adware.JS.MultiPlug.P
Fortinet	Adware/MultiPlug
AVG	JS:Browsermodifier-B [Trj]
DeepInstinct	MALICIOUS