Threat Database Adware PrestoSavings

PrestoSavings

By GoldSparrow in Adware

Threat Scorecard

Threat Level: 20 % (Normal)
Infected Computers: 111
First Seen: January 28, 2015
Last Seen: June 16, 2023
OS(es) Affected: Windows

PrestoSavings is a piece of adware, published by a company called Engauge Innovations, that will display annoying advertisements on your browser screen, if you are unfortunate enough to install PrestoSavings. Several malware experts also identify PrestoSavings as a Potentially Unwanted Program (PUP). PrestoSavings interrupts your browsing process every few minutes by showing you pop-ups, banners and coupons, but may also change your home page and new tab browser options. The form PrestoSavings takes on is as a BHO (Browser Helper Object) and installs as an add-on to your browser. PrestoSavings affects browsers like Internet Explorer, Mozilla Firefox and Google Chrome.

Is this Your Regular Run-of-the-Mill Adware?

The short answer is – yes. But, there are a few particular things, other than bombarding you with advertisements about products that may prove more harmful to your PC. In addition to spamming you with advertisements, PrestoSavings may redirect you to sites that may result in some other Potentially Unwanted Programs affecting you. What's more, PrestoSavings may collect personal information like IP address and other browsing information.

One of the ways of installing PrestoSavings is actually doing it on your own volition. Since you, like most people shopping on the Internet, are looking for the lowest prices and bargains on the Internet, one of the first thoughts popping up in your head when seeing this software must have been "This is exactly the type of add-on I need!". Some of the adverse effects are listed in the program's EULA, so by accepting them you technically are giving your consent to PrestoSavings to inject advertisements into your browser, amongst other things.

A page that offers a free download for the program even has a couple of reviews. They describe the piece of adware as a very helpful tool and exclaim how they've saved a respectable sum of money by using PrestoSavings. Needless to say, even if they are real reviews made by misguided users, it is not advised for you to install adware. PrestoSavings' aim is for you to buy the products from the sites PrestoSavings offers you. In addition to profiting from selective advertisements, the ones behind PrestoSavings may share your information with a third-party. Besides the payloads as mentioned above, PrestoSavings may slow your computer's performance.

Another way of contaminating your PC with the adware in question is by downloading PrestoSavings unknowingly together with video files, system utility tools or visiting harmful links. Some users have also reported having contracted the adware when trying to modify the look of their browser so always be careful of what you download and which sites you visit.

It also seems that PrestoSavings comes in pair with another supplementary object, which PrestoSavings installs in the following directory C:\Program Files\PrestoSavings\1.8\KangoEngine.exe. It affects Internet Explorer and helps PrestoSavings integrate itself into IE by installing KangoBHO.dll as an Internet Explorer BHO, toolbar and IE Web browser in Internet Explorer, under the name 'PrestoSavings'.
The associated files are:

  • uninstall.exe
  • KangoBHO.dll (by Kango) - Kango framework (Kango BHO)
  • KangoBHO64.dll (by Kango)
  • KangoEngine.exe - Kango Engine

How do I Get Rid of It?

The process of uninstallation is relatively simple. You can either do it by downloading an anti-malware program or just do it manually. Here are the steps you need to take if you opt for the second option:

  1. Go to the start menu and click Control Panel and then under Programs click:
    1. for Windows Vista/7/8 users: Uninstall a Program.
    2. for Windows XP users: Add or Remove Programs.
  2. Then you have to find the program PrestoSavings – Uninstall and then click:
    1. for Windows Vista/7/8 users: Uninstall.
    2. for Windows XP users: click Remove or Change/Remove button.
  3. Finally, follow the steps on the screen to complete the uninstallation.

By the looks of it, PrestoSavings doesn't pose that great of a risk to your privacy or computer. It never hurts to be careful, though, and as you may have guessed it yourself already you won't be finding any dirt cheap deals with its help.

SpyHunter Detects & Remove PrestoSavings

File System Details

PrestoSavings may create the following file(s):
# File Name MD5 Detections
1. PrestoSavings-prsto.1.11.1.exe f670518c9d8aeee0be5ec897e4da3298 0

Registry Details

PrestoSavings may create the following registry entry or registry entries:
CLSID
{55068883-BC74-42EA-9B20-31ED4E4428EA}
{61FC239E-FFCD-4F74-B709-47772F636B57}
{9754A33D-37F9-4629-B1EB-C65CF8F526D5}
SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{55068883-BC74-42EA-9B20-31ED4E4428EA}
SOFTWARE\Microsoft\Internet Explorer\Toolbar\{9754A33D-37F9-4629-B1EB-C65CF8F526D5}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{55068883-BC74-42EA-9B20-31ED4E4428EA}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{9754A33D-37F9-4629-B1EB-C65CF8F526D5}
SOFTWARE\Wow6432Node\{61FC239E-FFCD-4F74-B709-47772F636B57}

Directories

PrestoSavings may create the following directory or directories:

%LOCALAPPDATA%\PrestoSavings
%PROGRAMFILES%\PrestoSavings
%PROGRAMFILES(x86)%\PrestoSavings

Trending

Most Viewed

Loading...