Adware.Savinshop

Posted: February 26, 2014

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	16,389
Threat Level:	2/10
Infected PCs:	3,345

First Seen:	February 26, 2014
Last Seen:	February 7, 2025
OS(es) Affected:	Windows

SavinsHop is an adware program that may claim to provide shopping deals, but does little of benefit for your browser. As with all adware add-ons, SavinsHop's primary purpose is to launch advertisements that may or may not be of interest to you. This constant, uncontrolled exposure to third party content may cause a variety of security-related issues, and malware researchers consider deleting SavinsHop to be an obvious recommendation with no drawbacks. Using dependable security software with adware-removing features also will help to provide increased assurance that any settings changes or other side effects of SavinsHop are truly removed from your browser.

The Savings that Hop to You Even if You'd Rather They Didn't

SavinsHop is one of many advertising add-ons that have been known to use automatic means of installing themselves. Although some exploits and Trojan attacks certainly may be capable of installing SavinsHop, malware experts currently suspect that SavinsHop is being distributed through free software bundles. These multiple-software installers may be detected by appropriate security products, even though the installation process may show few to no signs of SavinsHop's being installed.

Once SavinsHop does find a way onto your hard drive, SavinsHop may modify your browser so that SavinsHop loads additional advertising content that's unrelated to any Web pages you might be browsing. Although SavinsHop's advertisements may be themed to resemble shopping bargains, malware researchers have verified that SavinsHop's advertising partners offer few to no real shopping benefits, comparative to using a simple search engine. Besides its uncertain advantages, SavinsHop's advertising also may expose you to misleading tactics or scripted attacks against your PC, and may create poor browser performance.

Doing Your Shopping with Less SavinsHop Leaning Over Your Shoulder

Like most adware programs that know full well that their features aren't wanted, SavinsHop doesn't allow its advertisements to be disabled through your browser's settings. Most PC users also experience various degrees of trouble with deleting SavinsHop, which may require the recruitment of suitable anti-adware products to resolve the issue. While removing SavinsHop, keep in mind that its advertisements may not be filtered for your personal safety, and try to avoid any unnecessary exposure to them until you've deleted all browser modifications that have any associations with this adware.

SavinsHop, sometimes identified by the alias ADWARE/Adware.A.2611, may be installed automatically. Browsing habits that avoid sites known to traffic in adware, browser settings that disable often-exploited features and regular anti-malware scans should deal with all of the common means of installing adware onto your PC.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%ALLUSERSPROFILE%\savinshop\VKKpmA.x64.dll

File name: VKKpmA.x64.dll
Size: 475.13 KB (475136 bytes)
MD5: f4516bfabbacb00b8ce9a879d38d1f60
Detection count: 81
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\saviNshOp\_p2WJRnu.dll

File name: _p2WJRnu.dll
Size: 429.05 KB (429056 bytes)
MD5: e6bff6caea9de08f1749605085cbf372
Detection count: 76
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\saviNshOp
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\Datos de programa\savinsHop\ftAvVHW.dll

File name: ftAvVHW.dll
Size: 422.91 KB (422912 bytes)
MD5: 2ed8da092715ffec84948687d4d948cb
Detection count: 74
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Datos de programa\savinsHop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\Application Data\savINShop\sT.dll

File name: sT.dll
Size: 425.47 KB (425472 bytes)
MD5: eace1e9177cd7d9dcd46b80540de87b5
Detection count: 72
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\Application Data\savINShop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshOp\6erYO.x64.dll

File name: 6erYO.x64.dll
Size: 477.18 KB (477184 bytes)
MD5: 30aba12a9a32cb4d6b5e9b040fa5e9e1
Detection count: 66
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshOp
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\sAviNshop\i.x64.dll

File name: i.x64.dll
Size: 475.13 KB (475136 bytes)
MD5: 0cd8267b8e25fd8f161c62bfa2e29cbb
Detection count: 62
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\sAviNshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\GkVICTYxZw.x64.dll

File name: GkVICTYxZw.x64.dll
Size: 475.64 KB (475648 bytes)
MD5: a3d14b273b0dbceead701881edbf63c8
Detection count: 61
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshoP\J.x64.dll

File name: J.x64.dll
Size: 471.55 KB (471552 bytes)
MD5: d5cc256d07bcb9736bfb7afd26ec8a72
Detection count: 60
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshoP
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\WnlBpIPe.x64.dll

File name: WnlBpIPe.x64.dll
Size: 475.64 KB (475648 bytes)
MD5: 813c78939b935f42431c1911497b9d5b
Detection count: 43
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\PkhG.dll

File name: PkhG.dll
Size: 423.93 KB (423936 bytes)
MD5: b54415851f13177de7981ccc01273160
Detection count: 36
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshopp\FYz0.x64.dll

File name: FYz0.x64.dll
Size: 475.64 KB (475648 bytes)
MD5: 35194d6d139da5df913b84ffd3a337c4
Detection count: 35
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshopp
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\SavInshop\5.x64.dll

File name: 5.x64.dll
Size: 477.18 KB (477184 bytes)
MD5: a2f09f6b1006cf77f6bb8ed417df1757
Detection count: 35
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\SavInshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinShop\R.x64.dll

File name: R.x64.dll
Size: 473.6 KB (473600 bytes)
MD5: 016c1fcaeb2075b0c886fedda5eacdae
Detection count: 33
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinShop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\ssavinshop\p8TUoAU9t_.x64.dll

File name: p8TUoAU9t_.x64.dll
Size: 472.57 KB (472576 bytes)
MD5: f5cf7535dbd84232d6c1274725a10740
Detection count: 26
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\ssavinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinsHop\yXRLZ6.x64.dll

File name: yXRLZ6.x64.dll
Size: 476.67 KB (476672 bytes)
MD5: f2b26f32a57f0fd02019694516d3119b
Detection count: 19
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinsHop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\saviNshop\z8.x64.dll

File name: z8.x64.dll
Size: 472.57 KB (472576 bytes)
MD5: 31799857cf0e3a176581ee3465e44100
Detection count: 14
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\saviNshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\jw1xLT78Qo.x64.dll

File name: jw1xLT78Qo.x64.dll
Size: 470.52 KB (470528 bytes)
MD5: 347f697b9fe128ad15b16a7d3a28e821
Detection count: 12
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\saviNshopp\uLahVzc.x64.dll

File name: uLahVzc.x64.dll
Size: 472.06 KB (472064 bytes)
MD5: 2dd6b237480a217fbed6ccb9c543d6b8
Detection count: 11
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\saviNshopp
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\H.x64.dll

File name: H.x64.dll
Size: 473.6 KB (473600 bytes)
MD5: b3011447843f501a65edbeb2f5183fc1
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

%ALLUSERSPROFILE%\savinshop\NniahgH.x64.dll

File name: NniahgH.x64.dll
Size: 477.18 KB (477184 bytes)
MD5: 1b5119ed79a2f92c5f189fb3d555d80c
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %ALLUSERSPROFILE%\savinshop
Group: Malware file
Last Updated: February 26, 2014

More files

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\Application Data\savinsHop%ALLUSERSPROFILE%\saviNshopp%ALLUSERSPROFILE%\savinsHop

The following URL's were detected:

savinshop

One Comment

John says:

February 24, 2015 at 3:30 pm

John - Savinshop has morphed into "ssavinshop" (double s - "ss") - probably to avoid auto-detection.
My XP Pro running latest Firefox had its "add-ons" infected with ssavinshop. Oddly, although I "removed" it in the Firefox Add-on tab, and it looked like it was removed, when I went to Control Panel/Management/add-remove programs to check, it was not only still there, but clicking on Remove failed to remove it from the listing. I had to go to the Program Files folder to find that there was still a folder for ssavinshop and two .exe files their by similar names (which I've forgotten). Deleting that folder and its contents allowed me to go back to Add Remove Programs, and this time hitting Remove allowed me to strip the name from the listing.