Savingsbull

[Ozwynn]

It took me 2 hours to get rid of this. I finally did it by going into the task manager, finding savingsbull in the background applications, right click, file location, and then delete savingsbull.

this was after uninstalling it, and downloading a program with a powerful uninstaller and shredding the files and registry entries and removing it from IE and chrome. it needs to be removed from any browser you have installed, in win8 and 8.1 IE is a built in function so it cant be uninstalled, so this extension needs to be removed.

If you have savingsbull you probably also have search conduit so that also needs to be disabled and uninstalled.

Not sure where I got it because I have not downloaded anything since my notebook was new, but it started last night and it was redirecting every click of the mouse.


Savingsbull is persistent and hooks deep into the registry. it needs to be removed from several locations.

 

[Mark_88]

I've used the task mangler for finding files of apps...I've even hacked the registry a few times to get rid of things but it can be a bit intimidating...always back up the registry before you or any applications repair it...I think the apps do it automatically, but it's always nice to have a copy of it on your desktop in case the system gets wonky.

 

[SenorNoob]

For future reference. Sometimes even with an administrator account some files can't be erased in windows for whatever reason. When it comes to these, use a linux live-cd and delete the file that way. Saved my ass more than a few times.

 

[Ozwynn]

that would work if I had a cd drive or even a hard drive. this happened on my windows tablet which runs windows 8.1

maybe I could put linux live on a micro SD card.

 

[alwaysFlOoReD]

Forgive my lack of knowledge, what does savingsbull do?

 

[RonD]

Savingsbull is considered "adware", but some would say a virus and they would be close to right, lol.

It is often loaded when you accept free software or shareware downloads, always read and uncheck any "ad-ons" and always select "custom install", this will take longer but you will then be able to uncheck the "automatic install" ad-on stuff.

Once adware like this is accepted, and you do have to accept it, it will immediately try to disable any anti-virus or trojan hunters you might have to get rid of it.
It will then put reproduction files in different sub-directories so if you do manage to clean it off it will come back on the next reboot.
Then it starts to take over your search engines and browsers.

What it does for the company that made it, is to redirect the computer user to selected sites selling various products, Savingsbull gets paid for each hit, it gives a cookie to the site so Savingsbull gets the credit for the traffic.

It is a legit program in that you do need to accept it's installation and it is named, so not a hidden virus or trojan.
But..............it is one of those PITA type things you get with free stuff.

If you run any windows versions then you should have a software called RKill on a USB stick, it is a free program.
What it does is to stop all running programs that are not needed for basic windows operation.
It doesn't clean or repair, it just stops everything from running, so you can then clean anything bad from the files.
On the same USB stick have another free software loaded Malwarebytes.
If these are on the computer not a USB stick they will have been disable by Savingsbull or any other questionable software trying to "take over the world", lol.
So they need to be on a separate drive.
I also rename them, Punch for RKill and Judy for Malwarebytes, because as soon as you plug in that drive to infected computer, it will try to "kill" an RKill file.
Run RKill two times
Then install Malwarebytes on the computer and update it, it will take some time.
Then run Malwarebytes scan.

Any anti-virus or other "protection" software that was on the computer will be compromised, so after clean up uninstall those and reinstall fresh versions.

 

[alwaysFlOoReD]

^^^ Thanks.

 

[Ozwynn]

thats very useful. thank Ron. I figured out what happened. My 14 y/o downloaded a tube downloader for youtube videos. then uninstalled it before he got caught.

 

[adsm08]

If he has an actual need to save videos off Youtube get ClipGrab. I haven't had any issues with adware or spyware since I installed it.

 

[Ozwynn]

he is not allowed to use my tablet anymore.....

 

[KnockKnock]

that would work if I had a cd drive or even a hard drive. this happened on my windows tablet which runs windows 8.1

maybe I could put linux live on a micro SD card.

Not sure if it works on a SD, but for those looking to run Linux from a live USB, try YUMI, as it's also good for loading all kinds of other OS's from USB.

 

[Mark_88]

he is not allowed to use my tablet anymore.....

Best anti-virus around...keep the kids and others away from your computers/tablets et al