Home Malware Programs Adware Adware.SavingsAddon

Adware.SavingsAddon

Posted: April 4, 2013

Threat Metric

Threat Level: 2/10
Infected PCs: 447
First Seen: April 4, 2013
Last Seen: June 5, 2023
OS(es) Affected: Windows

SavingsAddon Screenshot 1Savings Addon is an adware program that displays numerous coupons offers and pop-up ads on popular websites, mainly online shopping websites, such as eBay, Amazon, Walmart and others. Savings Addon is mostly added to Internet Explorer, Mozilla Firefox and Google Chrome web browsers while PC users are downloading some other software products. Usually Savings Addon is bundled with free programs. Savings Addon may keep track of the victim's browsing activity and then use this information for marketing campaigns. Savings Addon invades affected computers without the victimized PC user's permission and knowledge; therefore, it is definitely an unwanted program.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

CLSID{55555555-5555-5555-5555-550255145526}{66666666-6666-6666-6666-660266146626}HKEY..\..\..\..{RegistryKeys}SOFTWARE\21426Software\AppDataLow\Software\Savings AddonSOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater21426.exeSOFTWARE\Savings AddonSOFTWARE\Wow6432Node\21426SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211141126}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211141126}SOFTWARE\Wow6432Node\Microsoft\Tracing\Savings Addon_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\Savings Addon_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\Updater21426_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\Updater21426_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211141126}SOFTWARE\Wow6432Node\Savings AddonHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}21426_Savings Addon

Additional Information

The following directories were created:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Savings Addon%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\iklfnijkecmmkjhjoamnpoemkpoppafe%LOCALAPPDATA%\Savings Addon%LOCALAPPDATA%\Updater21426%PROGRAMFILES%\Savings Addon%PROGRAMFILES(x86)%\Savings Addon
Loading...