MySafeSavings Ads

Posted: April 2, 2016

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	19,887
Threat Level:	2/10
Infected PCs:	17,809

First Seen:	April 2, 2016
Last Seen:	December 30, 2024
OS(es) Affected:	Windows

MySafeSavings is an adware program that loads advertising content through your Web browser. Although MySafeSavings lacks the characteristics of outright threats, such as a virus, MySafeSavings does include semi-invasive routines for maintaining its presence on your system and has no notable benefits to the user. Although you can evaluate most unwanted programs on a scenario-specific basis, malware experts recommend removing MySafeSavings with your anti-adware products as a baseline response.

The Savings You Don't Get a Choice in Having

Although the individual profits of 'hits' on Web advertising are minimal, they also are relatively passive, which has led to the creation of automatic advertising software on a very regular basis. Some of these adware programs only make a minor impact on the affected system, but others, like MySafeSavings, may be more demanding than is standard. Besides its advertisement-delivering features, malware experts also confirmed MySafeSavings for using various exploits to prevent itself from being closed or deleted, making MySafeSavings a persistent security issue.

MySafeSavings is software specific to Windows OSes and may use features of that OS to guarantee that MySafeSavings continues running after every reboot. Because MySafeSavings maintains a constant state of system persistence, PC users are unable to delete MySafeSavings manually even after locating its program files (which MySafeSavings does not conceal). Closing MySafeSavings may prompt its immediate restart.

Some PC users have experienced limited success in blocking MySafeSavings's system startup routine by replacing its files with 'dummy' text files of the same name. However, this workaround has been inconsistent between MySafeSavings installations. Malware experts discourage it as a long-term solution since it leaves additional settings issues unchanged.

Like most adware, MySafeSavings is most obviously identifiable by its browser symptoms, which may include:

Pop-up windows.
Advertising content that may be injecting itself into a preexisting browser window.
Being redirected to MySafeSavings affiliate sites from any unrelated websites.

Making Your Browser Safe from MySafeSavings

MySafeSavings is an independent program, as opposed to a browser-specific add-on or extension. Consequentially, more than one browser may show its symptoms, and your Web browser's settings may have no effect on MySafeSavings advertisements. Both MySafeSavings's program files and its memory processes are displayed visibly, which can help PC users detect whether or not the adware is running after a removal attempt.

Although many PC security programs have yet to include database entries for MySafeSavings, malware experts find much better detection rates against its installation vehicle: a standard PUP installation tool. Scanning installation files before using them can give you a reliable means of avoiding adware like MySafeSavings, which may be harder to remove than it is to evade preemptively. Potentially Unwanted Program installers are known for circulating on free software domains and piracy-promoting download networks.

Malware experts also endorse the use of Safe Mode when scanning your PC for threats, and, especially, for mitigating the issues related to system-persistent programs. After rebooting into Safe Mode according to your OS developer's guidelines, use any anti-adware software as needed for scanning your PC and deleting MySafeSavings. Restart your computer a second time and verify that all MySafeSavings files still are removed before assuming that your browser is once again advertisement-free.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%ALLUSERSPROFILE%\Microsoft\Savman\savman.exe

File name: savman.exe
Size: 24.06 KB (24064 bytes)
MD5: 9b7084472a38f5f361f55e896a4cd9c0
Detection count: 300
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Microsoft\Savman
Group: Malware file
Last Updated: January 14, 2021

%ALLUSERSPROFILE%\Microsoft\Windows\WindowsCredentialManager\wcmasc.exe

File name: wcmasc.exe
Size: 994.81 KB (994816 bytes)
MD5: 56552d503915e3f029294d1b6c9e4735
Detection count: 112
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Microsoft\Windows\WindowsCredentialManager
Group: Malware file
Last Updated: July 24, 2018

C:\ProgramData\Microsoft\WindowsLogger\winlogger.exe

File name: winlogger.exe
Size: 25.08 KB (25088 bytes)
MD5: c8536753cb6659ed0696e2b8cf4d75fc
Detection count: 82
File type: Executable File
Mime Type: unknown/exe
Path: C:\ProgramData\Microsoft\WindowsLogger\winlogger.exe
Group: Malware file
Last Updated: July 19, 2022

%PROGRAMFILES(x86)%\MySafeSavings\mysafesavings.exe

File name: mysafesavings.exe
Size: 2.35 MB (2356224 bytes)
MD5: 6eebaf447aa2a4bc0473e99bf6ff8197
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\MySafeSavings
Group: Malware file
Last Updated: September 16, 2018

gpsetup.exe

File name: gpsetup.exe
Size: 1.01 MB (1014617 bytes)
MD5: 8b9894f1a42cd71361aa4322ea7b184e
Detection count: 22
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 4, 2016

More files

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%ALLUSERSPROFILE%\Microsoft\Windows\WindowsAccountManager\smass.exe%ALLUSERSPROFILE%\Microsoft\Windows\WindowsCredentialManager\wcmasc.exeHKEY..\..\..\..{RegistryKeys}SOFTWARE\MSSavingsSoftware\MSSTabSOFTWARE\MySafeSavingsSOFTWARE\WOW6432Node\MSSavingsSOFTWARE\Wow6432Node\MySafeSavingsHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}MSeSavingsMySafeSavings

Additional Information

The following directories were created:

%ALLUSERSPROFILE%\MSSavings%ALLUSERSPROFILE%\Microsoft\Savman%ALLUSERSPROFILE%\Microsoft\WindowsLogger%ALLUSERSPROFILE%\Microsoft\Windows\WindowsAccManager%ALLUSERSPROFILE%\MySafeSavings%ALLUSERSPROFILE%\SafeSavings%PROGRAMFILES%\MSSavings%PROGRAMFILES%\MySafeSavings%PROGRAMFILES%\SafeSavings%PROGRAMFILES(x86)%\MSSavings%PROGRAMFILES(x86)%\MySafeSavings%PROGRAMFILES(x86)%\SafeSavings