Home Malware Programs Adware Tiger Savings

Tiger Savings

Posted: April 12, 2013

Threat Metric

Ranking: 14,549
Threat Level: 2/10
Infected PCs: 2,944
First Seen: April 11, 2013
Last Seen: February 12, 2025
OS(es) Affected: Windows

Tiger Savings is an adware program that displays numerous coupons on the targeted computer while web users are browsing the web. Pop-up messages displayed by Tiger Savings show up on popular websites, such as Facebook, eBay, Amazon and others. Tiger Savings is usually inserted into Internet Explorer, Mozilla Firefox or Google Chrome. Tiger Savings is installed together with free software downloads that PC users download from the Internet. Tiger Savings enters the victimized PC stealthily because often computer users perform all off installations automatically without paying much attention to its steps. This way Internet users do not deselect an option that says to download Tiger Savings and the program is installed automatically on their computers. Tiger Savings can cause unwanted redirects to hijacked websites or press to click on a malicious link. Tiger Savings can keep track of the victim's online activities and can even access his/her login information or passwords. Tiger Savings can trace which websites the PC user is visiting, and then sends this information to the remote server and later uses it for marketing campaigns.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

CLSID{11111111-1111-1111-1111-110111271167}{22222222-2222-2222-2222-220122272267}{44444444-4444-4444-4444-440144274467}{55555555-5555-5555-5555-550155275567}{66666666-6666-6666-6666-660166276667}HKEY..\..\..\..{RegistryKeys}Software\AppDataLow\Software\Crossrider\onBeforeNavigate\12767Software\AppDataLow\Software\Crossrider\onRequest\12767Software\AppDataLow\Software\Tiger SavingsSOFTWARE\Classes\CrossriderApp0012767.BHOSOFTWARE\Classes\CrossriderApp0012767.BHO.1SOFTWARE\Classes\CrossriderApp0012767.SandboxSOFTWARE\Classes\CrossriderApp0012767.Sandbox.1Software\Cr_Installer\12767Software\InstalledBrowserExtensions\215 Apps\12767SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271167}SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271167}SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Updater12767.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271167}SOFTWARE\Tiger SavingsSOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271167}SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271167}SOFTWARE\Wow6432Node\Microsoft\Tracing\Tiger Savings_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\Tiger Savings_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111271167}SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271167}SOFTWARE\Wow6432Node\Tiger SavingsHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Tiger Savings

Additional Information

The following directories were created:
%LOCALAPPDATA%\Tiger Savings%LOCALAPPDATA%\Updater12767%PROGRAMFILES%\Tiger Savings%PROGRAMFILES(x86)%\Tiger Savings%UserProfile%\Local Settings\Application Data\Tiger Savings%UserProfile%\Local Settings\Application Data\Updater12767
The following URL's were detected:
Tiger Savings
Loading...