Home / malware

PDF

Adware:Win32/SaveShare

First posted on 24 September 2013.
Source: Microsoft

Aliases :

There are no other names known for Adware:Win32/SaveShare.

Explanation :

Threat behavior

Installation

The program creates a number of registry keys to ensure that is displays advertisements in Bing and Google search engines as part of its installation routine, commonly with a file name similar to "SaveNshare"; however, each installer will use a slightly different name, typically by adding extra vowels, doubling up letters, or inserting punctuation.

It adds itself as a Windows add-on with the name "syaveNsHaRue a".

In Chrome, it installs itself as an extension with the name "syaveNsHaRue a".



The program creates an entry in the Add or Remove Programs section of the Control Panel. Deleting this entry might stop the adware running, but will not stop ads from displaying.



Behavior


Once installed, Adware:Win32/SaveShare displays ads if you search using Bing or Google:









Analysis by Chris Stubbs

Symptoms

You might see extra advertisements when using search engines such as Bing and Google.

Last update 24 September 2013

 

TOP