84,488,480 programs installed

Should I remove Safe Saver?

What percent of users and experts removed it?
83% remove it17% keep it
Overall Sentiment
Bad
What do people think about it?
(click star to rate)
How common is it?
Global Rank #14,237
United States Rank #7,029
Reach 0.0204%
Lifespan of installation (until removal)
< 28.64 days
844.89 days >
Average installed length: 443.92 days

Versions

VersionDistribution
1.27.153.8 79.35%
1.27.153.5 20.65%

Safe Saver

What is Safe Saver?

Safe Saver (Safe Save) from Moshe Caspi of bestdealapp.info is an adware/spyware web browser hijacker. The browser extension includes various features that will modify the default or custom settings of the browser including the home page and search settings. The browser extension will modify the user's home page and search settings as well as various other web browser functionality such as new tabs, etc.

In addition, the software will manipulate the security of the PC and Windows Internet Explorer by setting approved security zones for the following domains:
- reportbox3.info
- world-downloads.info
- goodbarlife.com (fallback domain)
- grapzip.in

Safe Save malware will then attempt to download various files from these domains and install them within the OS in various temporary directories such as the Internet Explorer Cache. Once installed, the software will add various execution points including a CopyHookHandler, and Approved Shell Extension, a Browser Helper Object and Plugins for Chrome and Firefox.

About  (from Moshe Caspi)

Safe Saver is a brand new cross browser add-on that helps you to get the best online shopping experience. As soon as it is downloaded and installed, it scans the Web for the latest coupons, and discounts.
Overview
  • Possible malware installed by this program
  • Automatically starts with Windows
  • Loads into the web browser
  • Built on the Crossrider toolbar platform and potentially unwanted
  • May inject ads in the web browser
  • 'Offers' to modify the browser's home and search pages by default
  • Difficult to remove as it will reinstall itself
  • Typically distributed through a pay-per-install bundle
  • Hijacks the web browser's home page
  • The experts agree, you should remove it!
Warning, multiple anti-virus scanners have detected possible malware in Safe Saver.
utils.exe (98765eda7372fcbe329b702a3a80ab09) has been flagged by the following 10 scanners:
Anti-Virus softwareVersionDetection
Antiy-AVL 2.0.3.7 AdWare/Win32.Lyckriks
Baidu-International 4.0.3.131024 Trojan.Win32.Agent.AwLZ
Bkav FE 1.3.0.4261 W32.Clodf83.Trojan
Dr.Web 9.0.0.0297 Adware.Plugin.73
ESET-NOD32 7.8954 Win32/Packed.ScrambleWrapper.C
Fortinet FortiGate 10/24/2013 Adware/Lyckriks
Jiangmin KV131024 AdWare/Lyckriks.bf
Kaspersky 14.0.0.4257 not-a-virus:AdWare.Win32.Lyckriks
TrendMicro-HouseCall 7.2.297 TROJ_GEN.R0CBH07JG13
Vba32 AntiVirus 3.12.24.3 AdWare.Lyckriks
Safe Saver-bho.dll (f75b89c57d58fbfb6c6b500292d30005) has been flagged by the following 8 scanners:
Anti-Virus softwareSoftware versionDetection
Dr.Web Trojan.Crossrider.1
ESET-NOD32 8963 a variant of Win32/Toolbar.CrossRider.H
K7 AntiVirus 9.173.9980 Riskware
K7GW 12.7.0.14 Riskware
Kingsoft AntiVirus 2013.4.9.267 Win32.Troj.Generic.a.(kcloud)
McAfee 5.600.0.1067 Artemis!F75B89C57D58
McAfee-GW-Edition 2013 Artemis!F75B89C57D58
VIPRE Antivirus 22702 Crossrider (fs)
Safe Saver-enabler.exe (780958166d993a0e5a2afa77ac7a13f3) has been flagged by the following 6 scanners:
Anti-Virus softwareSoftware versionDetection
ESET-NOD32 8943 a variant of Win32/Toolbar.CrossRider.J
Kingsoft AntiVirus 2013.4.9.267 Win32.Troj.Generic.a.(kcloud)
McAfee 5.600.0.1067 Artemis!780958166D99
McAfee-GW-Edition 2013 Artemis!780958166D99
TrendMicro-HouseCall 9.700.0.1001 TROJ_GEN.F47V1015
VIPRE Antivirus 22588 Crossrider (fs)
Safe Saver-updater.exe (90ad4750e6c43eb3d0a5e4a78492922b) has been flagged by the following 5 scanners:
Anti-Virus softwareSoftware versionDetection
AVG 13.0.0.3169 Generic_r.GS
ESET-NOD32 8944 a variant of Win32/Toolbar.CrossRider.J
Kingsoft AntiVirus 2013.4.9.267 Win32.Troj.Generic.a.(kcloud)
TrendMicro-HouseCall 9.700.0.1001 TROJ_GEN.F47V0925
VIPRE Antivirus 22592 Crossrider (fs)
Safe Saver-codedownloader.exe (082f2fb8f2e1247ddc2c7c7888cdafe2) has been flagged by the following 4 scanners:
Anti-Virus softwareSoftware versionDetection
Dr.Web Trojan.Crossrider.1
ESET-NOD32 8840 a variant of Win32/Toolbar.CrossRider.I
Kingsoft AntiVirus 2013.4.9.267 Win32.Troj.Generic.a.(kcloud)
VIPRE Antivirus 21806 Crossrider (fs)
       View all 33 all detections
Safe Saver has been found to be bundled with 3rd party software. If you have not purposefully installed this, you should be safe uninstalling it.

Program detailsProgram details

Displayed publisher: Safe Saver
URL: safesaver.net
Installation folder: C:\Program Files\safe saver
Uninstaller: C:\Program Files\Safe Saver\Uninstall.exe
Estimated size: 7.31 MB

Program filesFiles installed by Safe Saver

Program executable:utils.exe (Malware detected)
Name:Safe Saver
Safe Saver Installer
Path:C:\Program Files\safe saver\utils.exe
MD5:98765eda7372fcbe329b702a3a80ab09
Additional files:
  • Safe Saver-bg.exe - Safe Saver (Safe Saver exe)
  • (Malware detected) Safe Saver-bho.dll - Safe Saver BHO
  • Safe Saver-buttonutil.exe
  • Safe Saver-buttonutil64.exe
  • Safe Saver-chromeinstaller.exe
  • (Malware detected) Safe Saver-codedownloader.exe
  • (Malware detected) Safe Saver-enabler.exe
  • Safe Saver-firefoxinstaller.exe
  • (Malware detected) Safe Saver-updater.exe
  • Uninstall.exe - Safe Saver Installer

Program behaviorsBehaviors exhibited

Internet Explorer BHO
  • Safe Saver-bho.dll is installed in Internet Explorer as a BHO (Browser Helper Object) under the name 'Safe Saver' with the class of {11111111-1111-1111-1111-110311321154} (CrossriderApp0033254).
Scheduled Task
  • Safe Saver-enabler.exe is scheduled as a task named 'temp_Safe Saver-enabler'.
5 Scheduled Tasks (Boot/Login)
  • Safe Saver-enabler.exe is automatically launched at startup through a scheduled task named Safe Saver-enabler.
  • Safe Saver-firefoxinstaller.exe is automatically launched at startup through a scheduled task named Safe Saver-firefoxinstaller.
  • Safe Saver-chromeinstaller.exe is automatically launched at startup through a scheduled task named Safe Saver-chromeinstaller.
  • Safe Saver-updater.exe is automatically launched at startup through a scheduled task named Safe Saver-updater.
  • Safe Saver-codedownloader.exe is automatically launched at startup through a scheduled task named Safe Saver-codedownloader.

How do I remove Safe Saver?

You can uninstall Safe Saver from your computer by using the Add/Remove Program feature in the Window's Control Panel.
  1. On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do one of the following:
    • Windows Vista/7/8/10: Click Uninstall a Program.
    • Windows XP: Click Add or Remove Programs.
  2. When you find the program Safe Saver, click it, and then do one of the following:
    • Windows Vista/7/8/10: Click Uninstall.
    • Windows XP: Click the Remove or Change/Remove tab (to the right of the program).
  3. Follow the prompts. A progress bar shows you how long it will take to remove Safe Saver.
  4. If for some reason uninstallation fails, please install Microsoft's uninstall fixer utility which will help fix problems with programs that can't be uninstalled at support.microsoft.com.

How do I reset my web browser?

If your web browser homepage and search settings have been modfied by Safe Saver you can restore them to their previous default settings.
Microsoft Internet Explorer
Mozilla Firefox
Google Chrome

OS VERSIONS
Win 7 (SP1) 59%
Win Vista 0%
 
HOW IT STARTS
Scheduled task? Yes
(Runs on Windows boot)
 
USER ACTIONS
Uninstall it 83%
Keep it 17%

Windows OS versionsWindows

Which Windows OS versions does it run on?
Windows 7 62.44%
Windows 10 17.66%
Windows Vista 10.95%
Windows XP 8.96%
Which OS releases does it run on?
Windows 7 Home Premium 47.74%
Windows 8 10.05%
Windows Vista Home Premiu... 8.79%
Microsoft Windows XP 8.54%
Windows 7 Professional 7.79%
Windows 7 Ultimate 6.53%

Distribution by countryGeography

98.31% of installs come from the United States
Which countries install it?
  United States 98.31%
  Canada 0.46%
  Brazil 0.15%
  Thailand 0.15%
  Colombia 0.15%
  NG 0.15%
  BS 0.15%
  Germany 0.15%
  Italy 0.15%
  Saudi Arabia 0.15%

OEM distributionPC manufacturers

What PC manufacturers (OEMs) have it installed?
Hewlett-Packard 35.22%
Dell 31.56%
Acer 10.63%
Toshiba 6.31%
Lenovo 5.32%
ASUS 3.65%
GIGABYTE 2.99%
Intel 2.66%
Gateway 1.00%
Samsung 0.66%
Common models
HP Pavilion g7 Notebook P... 4.86%
HP Pavilion dv7 Notebook ... 4.32%
HP 2000 Notebook PC 3.78%
HP Pavilion g6 Notebook P... 3.24%
Dell Inspiron 3520 2.70%
HP Pavilion dv6 Notebook ... 2.70%


commentsComments

user comment
No one has commented yet. Help others learn more about this software, share your comments.