Safe Saver

Posted: July 12, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	16,973
Threat Level:	2/10
Infected PCs:	450

First Seen:	July 12, 2013
Last Seen:	August 24, 2023
OS(es) Affected:	Windows

Safesaver (an independent program from the similarly branded Safersaver) is a Potentially Unwanted Program and an add-on to your Web browser. Examinations by malware experts failed to detect any threatening components or behavior related to Safesaver, but Safesaver may include advertising functions that may have adverse results on your browser of choice. For PC users who haven't installed and used Safesaver intentionally, removing Safesaver typically should be considered the preferable option, for letting your browser load safely and with the best possible performance.

Saving with Safesaver whether You Want to or Not

Safesaver is a new addition to the bulk of advertising add-ons that may install themselves through bundles with other products. In some incidents, these bundles may include other forms of adware in addition to Safesaver, such as the ironically-named Adsblocker program. Safesaver and related advertising programs may modify Web pages as your browser loads them, allowing their related adware to inject extra advertising content.

Advertisements by Safesaver software may include both text-based links, as well as banners, pop-ups and other graphical elements. Safesaver markets all of its advertisements as ways to save money through coupons and time-limited bargains. Nonetheless, malware experts note that it's unlikely that Safesaver advertisements may provide superior savings relative to intelligent usage of search engines.

Meanwhile, Safesaver's additional advertisements may increase your browser's loading times or cause other, unforeseen issues with your browser's performance. Web pages forced to load Safesaver advertisements may behave unpredictably, as a result of the new content that they weren't meant to host.

Getting a Safer Browser than One Saddled with Safesaver

Whereas legitimate shopping software should allow you to uninstall it easily, Safesaver sets itself apart as a Potentially Unwanted Program by blocking common uninstall procedures, such as via your Windows Control Panel. Any browsers modified by Safesaver automatically should be capable of reversions after deleting Safesaver with anti-malware software. This software also should be capable of detecting any other unwanted program with the same installation date as Safesaver.

As usual, the installation techniques preferred by Safesaver and other adware focus on methods, such as bundling with other applications. In the past, malware experts have found that certain free software websites and popular torrent downloads are common sources of adware bundles. However, the involvement of threats never should be discounted, until you've scanned your PC to confirm the lack of Trojan downloads and similar threats. Individual files from suspicious sources also should be analyzed to detect Safesaver installation bundles before Safesaver can modify your browser. Because of its relatively recent identification, malware researchers have yet to confirm all of Safesaver's potential browser compatibilities. Mac and Windows browsers, such as Safari, Firefox, Chrome and Internet Explorer, are estimated to be at the biggest risk of being forced to load Safesaver advertisements.

Aliases

Generic_r.GS [AVG]Artemis!780958166D99 [McAfee]Riskware [K7AntiVirus]Artemis!F75B89C57D58 [McAfee]

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES%\Safe Saver\Safe Saver-bho.dll

File name: Safe Saver-bho.dll
Size: 752.48 KB (752488 bytes)
MD5: 813a675a972640634f204f7ec6abc32f
Detection count: 56
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Safe Saver
Group: Malware file
Last Updated: November 22, 2013

%PROGRAMFILES(x86)%\Safe-Saver App\Safe-Saver App-enabler.exe

File name: Safe-Saver App-enabler.exe
Size: 348.52 KB (348520 bytes)
MD5: 94e89d6f36bda940c0ed106072dacc20
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Safe-Saver App
Group: Malware file
Last Updated: January 8, 2014

%PROGRAMFILES(x86)%\Safe-Saver App\Safe-Saver App-firefoxinstaller.exe

File name: Safe-Saver App-firefoxinstaller.exe
Size: 891.24 KB (891240 bytes)
MD5: b843e61005fbd81f1aa9c14d489ba15b
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Safe-Saver App
Group: Malware file
Last Updated: January 8, 2014

%PROGRAMFILES(x86)%\Safe-Saver App\Safe-Saver App-updater.exe

File name: Safe-Saver App-updater.exe
Size: 358.76 KB (358760 bytes)
MD5: 9d5c3a5275b31cfdde7fcb7ebd65c4d0
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\Safe-Saver App
Group: Malware file
Last Updated: January 8, 2014

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}Software\InstalledBrowserExtensions\Safe SaverSoftware\Microsoft\Internet Explorer\Approved Extensions\{11111111-1111-1111-1111-110311391186}Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{11111111-1111-1111-1111-110311391186}SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Safe-Saver Generic-bg.exeSoftware\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{11111111-1111-1111-1111-110311391186}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\Safe-Saver Generic-bg.exe

Additional Information

The following directories were created:

%APPDATA%\Safe-Saver App%PROGRAMFILES%\Safe-Saver App%PROGRAMFILES(x86)%\Safe-Saver App%ProgramFiles%\Safe-Saver Generic%ProgramFiles(x86)%\Safe-Saver Generic

The following URL's were detected:

safe saveu