Home Malware Programs Adware Savings Shield

Savings Shield

Posted: October 1, 2013

Threat Metric

Threat Level: 2/10
Infected PCs: 49
First Seen: October 1, 2013
Last Seen: January 19, 2022
OS(es) Affected: Windows

Savings Shield is an adware program that may display pop-up advertisements, offers, coupons, and sponsored links via a pop-up box on Amazon, Walmart, Ebay and other shopping websites that web users are visiting. Savings Shield pop-up advertisements may be displayed as boxes, which encompass a variety of coupons that are available or as underlined keywords, which when clicked may show a pop-up advertisement that declares it is sent to an affected computer user by Savings Shield. Savings Shield is an unwanted extension for Internet Explorer, Mozilla Firefox and Google Chrome that may be usually inserted when the Internet user installs other free applications, such as video recording/streaming, download managers or PDF creators, that had packed into their installation Savings Shield. When the PC user installs these free applications, they may also install Savings Shield. When installed on the targeted PC, whenever the computer user will visit Best Buy, Expedia, Facebook or any other similar websites, Savings Shield may show a 'See Similar' button on product images, which when clicked may display pop-up ads by Savings Shield. Savings Shield may also display advertising banners on the websites that computer users are visiting, and as they surf the Internet, Savings Shield may show coupons and other deals available on numerous websites.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\Savings Shield\Savings Shield-bho64.dll File name: Savings Shield-bho64.dll
Size: 944.52 KB (944520 bytes)
MD5: b5adac7acba3a24bff5df75c2e495d85
Detection count: 99
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Savings Shield
Group: Malware file
Last Updated: October 2, 2013
%PROGRAMFILES%\Savings Shield\Savings Shield-bho.dll File name: Savings Shield-bho.dll
Size: 602.5 KB (602504 bytes)
MD5: 0849765860f8ceefc677ac170f9ce510
Detection count: 19
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES%\Savings Shield
Group: Malware file
Last Updated: October 2, 2013
%PROGRAMFILES%\Savings Shield\SavingsShield.exe File name: SavingsShield.exe
Size: 3.87 MB (3872184 bytes)
MD5: fab073429fcad69bdf76b67740d76458
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Savings Shield
Group: Malware file
Last Updated: October 2, 2013
%PROGRAMFILES%\Savings Shield\Savings Shield-codedownloader.exe File name: Savings Shield-codedownloader.exe
Size: 491.4 KB (491400 bytes)
MD5: c784acf681210e5ac16d257bc9382670
Detection count: 4
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Savings Shield
Group: Malware file
Last Updated: October 2, 2013
%PROGRAMFILES%\Savings Shield\Savings Shield-bg.exe File name: Savings Shield-bg.exe
Size: 742.28 KB (742280 bytes)
MD5: 4ce786b992e80bef69f8756444485c8f
Detection count: 3
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Savings Shield
Group: Malware file
Last Updated: October 2, 2013

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{RegistryKeys}SOFTWARE\Savings ShieldSOFTWARE\Wow6432Node\Savings Shield

Additional Information

The following directories were created:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Savings Shield%LOCALAPPDATA%\Savings Shield%LOCALAPPDATA%\Updater32908%PROGRAMFILES%\Savings Shield%PROGRAMFILES(x86)%\Savings Shield
The following URL's were detected:
Savings Shield
Loading...