Home Malware Programs Adware Adware.WebSave

Adware.WebSave

Posted: January 30, 2014

Threat Metric

Ranking: 8,499
Threat Level: 2/10
Infected PCs: 14,022
First Seen: January 30, 2014
Last Seen: October 10, 2023
OS(es) Affected: Windows

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%ALLUSERSPROFILE%\weobsaavve\XinSkkcaC7u.exe File name: XinSkkcaC7u.exe
Size: 419.84 KB (419840 bytes)
MD5: 29ee858c305012ac7e619fc88b8871b2
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\weobsaavve\XinSkkcaC7u.exe
Group: Malware file
Last Updated: January 10, 2022
%PROGRAMFILES%\websave\LKRNUCr.dll File name: LKRNUCr.dll
Size: 535.05 KB (535055 bytes)
MD5: 9647bd96b0df6a4d3c76a1c944aeaa35
Detection count: 34
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\websave
Group: Malware file
Last Updated: February 12, 2014

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\safeweb.safewebSOFTWARE\Classes\safeweb.safeweb.1.1SOFTWARE\Classes\websaave.websaaveSOFTWARE\Classes\websaave.websaave.3.7SOFTWARE\Classes\websave.websaveSOFTWARE\Classes\websave.websave.3.7SOFTWARE\Classes\websavve.websavveSOFTWARE\Classes\websavve.websavve.3.7Software\Microsoft\Internet Explorer\Approved Extensions\{86393703-D8BD-4B31-C9A1-79FF14B38CFE}Software\Microsoft\Internet Explorer\Approved Extensions\{AF71B355-07C4-025C-CA6C-D5BE3F76077D}Software\Microsoft\Internet Explorer\Approved Extensions\{BC6CA8E5-7205-E562-4264-78C8D8C22D80}Software\Microsoft\Internet Explorer\Approved Extensions\{ECA14627-7FC8-03E7-C72C-ECC3B3ABA234}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1A9D5CBD-560B-AAE6-5EDB-A3CF8621E2E2}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{336A7D45-FD6B-6307-DCB4-0B8107327778}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{425A69E1-699C-2BCF-C6A7-E280F3C3090E}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{539F0461-1852-3202-C340-8C4958CEAF2D}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{86393703-D8BD-4B31-C9A1-79FF14B38CFE}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A9A1A044-FDAF-A9EE-9D28-FA513E99138C}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{AF71B355-07C4-025C-CA6C-D5BE3F76077D}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{BC6CA8E5-7205-E562-4264-78C8D8C22D80}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{D6CB05A7-8D79-BD48-4C0F-963CF06B359B}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{DB9B07B2-1A9D-25BC-6BFD-637AA10D8A36}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{E2CABFBB-0C90-11E6-9BD5-F14229A368E7}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{ECA14627-7FC8-03E7-C72C-ECC3B3ABA234}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{FB6B7634-BEE5-E9FA-AEAC-750D7A91B273}SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{FB7A1DA2-6E81-14ED-2703-5B9A6019A342}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}{497C131E-2032-051B-B32A-C69A960FBB13}{7DD5E91C-3864-77EC-7635-D14910C2A03E}

Additional Information

The following directories were created:
%ALLUSERSPROFILE%\Application Data\ssafeweb%ALLUSERSPROFILE%\Application Data\websavE%ALLUSERSPROFILE%\seafEwaeb%ALLUSERSPROFILE%\ssAfeeweb%ALLUSERSPROFILE%\ssafeweb%ALLUSERSPROFILE%\weBsavie%ALLUSERSPROFILE%\websaVVe%ALLUSERSPROFILE%\websavE%ALLUSERSPROFILE%\weobsave%ALLUSERSPROFILE%\wuebsave%PROGRAMFILES%\safeweb%PROGRAMFILES%\seafEwaeb%PROGRAMFILES%\ssafeweb%PROGRAMFILES%\weBsavie%PROGRAMFILES%\webbsave%PROGRAMFILES%\websaVVe%PROGRAMFILES%\websaave%PROGRAMFILES%\websavE%PROGRAMFILES%\weobsave%PROGRAMFILES(x86)%\safeweb%PROGRAMFILES(x86)%\seafEwaeb%PROGRAMFILES(x86)%\ssafeweb%PROGRAMFILES(x86)%\weBsavie%PROGRAMFILES(x86)%\webbsave%PROGRAMFILES(x86)%\websaVVe%PROGRAMFILES(x86)%\websaave%PROGRAMFILES(x86)%\websavE%PROGRAMFILES(x86)%\wuebsave
The following URL's were detected:
wEbsavewebbsavewebsAveweobsavewuebsaVe
Loading...