SaveSense

SaveSense Description

SaveSense is adware that may display random pop-up ads, discount coupons, offers and deals via a pop-up box in well-known online shopping websites and social networking websites that computer users are visiting. SaveSense may insert an adware supported add-on, plug-in or extension for Mozilla Firefox, Internet Explorer and Google Chrome that may show pop-up, pop-under, banner, search, and in-text link interstitial ads. SaveSense may propagate and enter the PC throughout the installation of possibly unprotected free software downloads. SaveSense may commonly be embedded in the web browser when the computer user installs other free applications that may have added into their installation SaveSense. When the PC user installs free programs, he may also install SaveSense on the computer system. Once installed, SaveSense may highlight words on the websites that PC users are visiting changing them into hyperlinks. The links of SaveSense may be inserted within the text, and they may come with a double underline to separate them from usual links. When the PC user rolls the mouse over the link, the pop-up ads of SaveSense may emerge on the desktop of the computer system. If the PC user clicks on the pop-up links of SaveSense, the makers of the browser plug-in may make a profit from the clicks.

Infected with SaveSense? Scan Your PC for Free

Download SpyHunter’s Spyware Scanner
to Detect SaveSense

Security Doesn't Let You Download SpyHunter or Access the Internet?


Solutions: Your computer may have malware hiding in memory that prevents any program, including SpyHunter, from executing on your computer. Follow to download SpyHunter and gain access to the Internet:
  • Use an alternative browser. Malware may disable your browser. If you're using IE, for example, and having problems downloading SpyHunter, you should open Firefox, Chrome or Safari browser instead.
  • Use a removable media. Download SpyHunter on another clean computer, burn it to a USB flash drive, DVD/CD, or any preferred removable media, then install it on your infected computer and run SpyHunter's malware scanner.
  • Start Windows in Safe Mode. If you can not access your Window's desktop, reboot your computer in 'Safe Mode with Networking' and install SpyHunter in Safe Mode.
  • IE Users: Disable proxy server for Internet Explorer to browse the web with Internet Explorer or update your anti-spyware program. Malware modifies your Windows settings to use a proxy server to prevent you from browsing the web with IE.

If you still can't install SpyHunter? View other possible causes of installation issues.
Aliases: a variant of Win32/DealPly.M [ESET-NOD32], Artemis!6F2939B1EC17 [McAfee], MalSign.Generic.81E [AVG] and PUP.Optional.SaveSense.A [Malwarebytes].

Technical Information

Infection Statistics


Our MalwareTracker shows malware activity across the world. Explore real-time data of SaveSense outbreaks and other threats from global to local level.

File System Details

SaveSense creates the following file(s):
# File Name Size MD5 Detection Count
1 %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\doeiiacdhfmpdeckdaifnjaemmkkdlkf 297
2 %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\doeiiacdhfmpdeckdaifnjaemmkkdlkf 294
3 %PROGRAMFILES%\SaveSense 290
4 %PROGRAMFILES(x86)%\SaveSense 287
5 %ALLUSERSPROFILE%\SaveSenseLive 250
6 %APPDATA%\Microsoft\Windows\Start Menu\Programs\SaveSense 237
7 %LOCALAPPDATA%\SaveSense 237
8 %APPDATA%\SaveSense 234
9 %USERPROFILE%\Start Menu\Programs\SaveSense 231
10 %USERPROFILE%\Local Settings\SaveSenseLive 228
11 %PROGRAMFILES%\SaveSenseLive 225
12 %PROGRAMFILES(x86)%\SaveSenseLive 222
13 sas.exe 870,512 d05cf41a2e1e01e7842e2b643a6f2370 219
14 chrome-extension_doeiiacdhfmpdeckdaifnjaemmkkdlkf_0.localstorage 22
15 chrome-extension_doeiiacdhfmpdeckdaifnjaemmkkdlkf_0.localstorage-journal 19

More files

Registry Details

SaveSense creates the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}
Save Sense
HKEY..\..\..\..{RegistryKeys}
Software\Microsoft\Internet Explorer\Approved Extensions, value: {2E32CFE5-DF92-4AE5-B0BE-609ED0DF74A6}
Software\Microsoft\Internet Explorer\Approved Extensions, value: {71e129ff-6c2a-4984-818c-7e2c998b8d99}
SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A18D16ED-27B2-4B83-B70C-15E73F099546}
SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{214B6077-19A2-4A08-88A4-5A6AD3CA21C4}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F085B40F-FC11-41CF-AA84-5EEF3D35240C}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C5BB5234-33BB-445C-9F64-5A124580873E}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D60DA230-DC1B-449F-BA6E-26A71B289D27}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D98A2AA3-C404-4CBE-8473-CAFF471D824B}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{214B6077-19A2-4A08-88A4-5A6AD3CA21C4}
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F085B40F-FC11-41CF-AA84-5EEF3D35240C}
SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0f21b1e5-5afc-43c9-9c66-515046e92ec2}
SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2e32cfe5-df92-4ae5-b0be-609ed0df74a6}
SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{71e129ff-6c2a-4984-818c-7e2c998b8d99}
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{71e129ff-6c2a-4984-818c-7e2c998b8d99}
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A18D16ED-27B2-4B83-B70C-15E73F099546}
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2E32CFE5-DF92-4AE5-B0BE-609ED0DF74A6}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{71E129FF-6C2A-4984-818C-7E2C998B8D99}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2E32CFE5-DF92-4AE5-B0BE-609ED0DF74A6}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{71E129FF-6C2A-4984-818C-7E2C998B8D99}
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A18D16ED-27B2-4B83-B70C-15E73F099546}
SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Software\SaveSense
SOFTWARE\Wow6432Node\Google\Chrome\Extensions\doeiiacdhfmpdeckdaifnjaemmkkdlkf
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A18D16ED-27B2-4B83-B70C-15E73F099546}
SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2e32cfe5-df92-4ae5-b0be-609ed0df74a6}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{71e129ff-6c2a-4984-818c-7e2c998b8d99}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A18D16ED-27B2-4B83-B70C-15E73F099546}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{A18D16ED-27B2-4B83-B70C-15E73F099546}
The following CLSID's were found:
HKEY..\..\{CLSID Path}
{E7EA7058-B19B-4A27-B50A-87A1B8FC5F30}
{D79CBD8E-D857-4D05-B3AD-26F722CF5B6E}
{CDED8922-BB3D-4E3A-9C2C-89B1C927F48B}
{CDB98856-BEA3-4073-AF57-23A3583AE9E4}
{B7C67027-15EB-489F-A9EA-286076CF7540}
{ADE6A9C0-12B3-457D-9A86-548FA87E04DB}
{AB778974-218E-4734-90F0-731BE7E50E77}
{889074FC-1456-4CE8-88F7-154264DC275F}
{867DF9A9-D013-4A1A-B685-DFF65D225ED4}
{84A81B7E-B8CD-4891-BEA0-548D65E9610A}
{70E96298-17FC-4020-A7CF-6F81ED8CF3AB}
{6E1CD171-29C1-4D56-A223-E31C57A0A25A}
{4807D6D8-ADC8-41AF-AB9D-AE1086D1E62F}
{422E1393-7A4C-44FF-A7E1-8B9D146E0666}
{3AF4400F-CDC5-4F2D-B3F1-74348E5D5CCC}
{293DD661-C540-4AC4-9B4C-42E68369CE1B}
{13A42355-1F94-4459-B19E-F60B2C607C77}
{0EE6D408-6ED5-40C6-8C42-A041D5DE9AB0}
{F4B8D46C-4EEE-401B-8607-DC03025F34B1}
{E66A759D-367F-433E-85C6-ED7F040BCC32}
{CDDAB3A4-E64D-4AE0-9E1D-F3132F5F913F}
{C1424421-D274-491E-9D47-11C8D8CB5F9A}
{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
{99DCF141-03F9-4363-8D79-640FA646DEED}
{998745A3-2AE4-488D-8092-B98FB20A00C2}
{93D3100A-BBB6-456C-96FC-82CAC5F383AC}
{88C606E7-BA26-41CB-8CC3-D1E313E34E75}
{73192D81-6D24-4C40-BF7B-2507C6FA0B1A}
{44FC7A33-2E5C-48DC-B6F5-B81E8005D122}
{39A29266-D3E4-462D-AB05-F93B1053F6CF}
{27CE191D-733B-4450-AFCD-096D105288C3}
{997E3BFB-F821-411C-8B96-D61D415EC8FA}
{2e32cfe5-df92-4ae5-b0be-609ed0df74a6}

Site Disclaimer

Leave a Reply

IMPORTANT! To be able to proceed, you need to solve the following simple math.
Please leave these two fields as-is:
What is 12 + 8 ?