RRsavings

By GoldSparrow in Adware

Threat Scorecard

Ranking: 8,581
Threat Level: 20 % (Normal)
Infected Computers: 18,359
First Seen: April 16, 2014
Last Seen: February 20, 2024
OS(es) Affected: Windows

Rrsavings is a Potentially Unwanted Program. Rrsavings is classified as adware because its main goal is to subject PC users to advertising and marketing content so Rrsavings can generate monetary gain from advertisement sales and display sponsored content. Rrsavings may deliver advertisements to the affected Web browser, interrupting computer users with Web browser redirects, irritating pop-ups and a variety of other irritating symptoms. Rrsavings is installed as a Web browser toolbar that may be downloaded when installing free software with which Rrsavings is bundled. Security analysts regard Rrsavings as potentially harmful and strongly recommend its immediate removal. Because of this, if Rrsavings is installed on your machine, it is a wise decision to use a reliable security application to remove Rrsavings and all components associated with this PUP.

How a PC User can Acquire Rrsavings

PUPs like Rrsavings may be distributed by bundling them with low quality freeware distributed on questionable online platforms. When computer users download a free program, they may be invited to install a Web browser toolbar or extension such as Rrsavings. Many computer users may accept because they do not realize the nature of Rrsavings or because they misunderstand what these types of programs really do. Don't believe Rrsavings' marketing strategies. This Web browser toolbar is marketed as a way to save when shopping online, supposedly helping computer users find special deals. However, its main purpose is not to provide any useful service but, rather, to profit through advertising and cause various problems on affected computers.

Getting Rid of Rrsavings

Security researchers strongly advise removing Rrsavings immediately. In many cases, Rrsavings may interfere with your Web browser's settings, preventing you from removing Rrsavings completely. In these cases, PC security researchers recommend using the Windows Control Panel (Add/Remove Programs) to remove Rrsavings. However, there may be traces of Rrsavings left, or its pop-up advertisements may have exposed your computer to other potentially unwanted content. Therefore, a dependable anti-malware product should be utilized to scan the affected PC.

SpyHunter Detects & Remove RRsavings

File System Details

RRsavings may create the following file(s):
# File Name MD5 Detections
1. RrFilterService64.exe 5485823fff38f38c5223acfa65fbef44 8,597
2. RrFilterService.exe f072f99c07c01207723095a39ac08655 3,039
3. nuttkoqiez64.exe.vir 69ca9a1113f95f9c08c9031ab4418fbf 2,037
4. xmkysecqun32.exe 949a54971ef61e9d84b7c559b405a585 1,243
5. 2rs3.dll ad77ff6e76a918992054b22ba4164cea 347
6. uninstaller.exe aafaac1c20af333b2d933ad729b41947 84
7. xmkysecqun64.exe 1be089f9429924f29cf0b37f75af2ea4 41
8. xmkysecqun32.exe 505bd26474cb5047f334e4d1ba42cea9 21
9. tzdmorukil32.exe faced93009d35911f54120f5fc69b405 18
10. uninstaller.exe 8a7426eeca5871199e86fe9476e48ec2 14
11. uninstaller.exe d9f04b335047550c92ac1ea8c6796d40 11
12. RrFilterService64.exe e289cfa793f273ad6bd53984bf32d403 9
13. uninstaller.exe 83a6c8de284ba5a9e186461b551196dc 3
14. buuoujqmrk32.exe 9c23c48c01a0b6c04d6cd0e786b9a6c1 2
15. 2rs3.dll 71fb9134b3f42ceaaa0f629d5ecb6736 1
16. RrFilterService.exe 0871b8f26da9ce585f3d8b61e4c4ed22 1
17. buuoujqmrk32.exe d39b0c00f4aedfed4425c7c34b4b31f7 1
18. vxlsnyaiet32.exe f042aa4ef6da54c329eccf0557bd2b2f 1

Registry Details

RRsavings may create the following registry entry or registry entries:
Regexp file mask
%PROGRAMFILES%\002\yewimmxqbs64.exe
Software\AppDataLow\Software\Rr Savings
Software\AppDataLow\Software\rrsavings
SOFTWARE\Classes\Installer\Features\07BF6653227E2814286618E5EA689289
SOFTWARE\Classes\Installer\Products\07BF6653227E2814286618E5EA689289
Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\2D2D8A25-7FA3-4DEA-B84B-D55BA4E9AF2F
SOFTWARE\Rr Savings
SOFTWARE\RrFilter
SOFTWARE\rrsavings
SOFTWARE\Wow6432Node\RrFilter
SYSTEM\ControlSet001\Services\EventLog\Application\RrFilterService
SYSTEM\ControlSet001\services\eventlog\Application\RrFilterService64
SYSTEM\ControlSet001\services\RrFilterService
SYSTEM\ControlSet001\services\RrFilterService64
SYSTEM\ControlSet001\services\yewimmxqbs64
SYSTEM\ControlSet002\Services\EventLog\Application\RrFilterService
SYSTEM\ControlSet002\services\eventlog\Application\RrFilterService64
SYSTEM\ControlSet002\services\RrFilterService
SYSTEM\ControlSet002\services\RrFilterService64
SYSTEM\ControlSet002\services\yewimmxqbs64
SYSTEM\CurrentControlSet\Services\EventLog\Application\RrFilterService
SYSTEM\CurrentControlSet\services\eventlog\Application\RrFilterService64
SYSTEM\CurrentControlSet\services\RrFilterService
SYSTEM\CurrentControlSet\services\RrFilterService64
SYSTEM\CurrentControlSet\services\yewimmxqbs64

Directories

RRsavings may create the following directory or directories:

%PROGRAMFILES%\Rr Savings
%PROGRAMFILES%\RrFilter
%PROGRAMFILES%\rrsavings
%PROGRAMFILES(x86)%\Rr Savings
%PROGRAMFILES(x86)%\RrFilter
%PROGRAMFILES(x86)%\rrsavings
%WINDIR%\Installer\{3566FB70-E722-4182-8266-815EAE862998}

URLs

RRsavings may call the following URLs:

RrSavings

Trending

Most Viewed

Loading...