Threat Database Adware Savings Wizard

Savings Wizard

By GoldSparrow in Adware

Threat Scorecard

Ranking: 14,443
Threat Level: 20 % (Normal)
Infected Computers: 4,144
First Seen: November 13, 2013
Last Seen: September 9, 2023
OS(es) Affected: Windows

Savings Wizard Image

Savings Wizard is an adware threat that basically offers coupon deals and may promote other sites or services. Savings Wizard may be installed through other applications or freeware. Once loaded, Savings Wizard may cause automatic site redirects to unwanted sites. Additionally, Savings Wizard may trick computer users into installing other add-ons that attempt to provide services for your computer on the internet. Removal of Savings Wizard is essential to stop any ads from being displayed or redirects from taking place.

SpyHunter Detects & Remove Savings Wizard

File System Details

Savings Wizard may create the following file(s):
# File Name MD5 Detections
1. FrameworkBHO.dll f5d7b9c2cc901742953c1ea031366975 37
2. FrameworkBHO.dll 17d511a68e1c2238012639ef0f63c4a8 35
3. FrameworkBHO64.dll 8dea80a12395afb1dc87d69a2948dd99 6
4. FrameworkBHO.dll aefa6a48f511a2e1756d58a296ae80c4 3
5. FrameworkBHO64.dll 684ff5bde5b291b94894cab5f88b4c61 3
6. FrameworkBHO.dll 141fb4de48686bbd034a6c2a2c9aa2d9 2
7. FrameworkEngine.exe 7881e89eded3f391b1adda1c99064757 2
8. FrameworkBHO64.dll c6737944a247bcf003cd8f5b262e67cf 2
9. FrameworkBHO64.dll 05b9f0d127360b9e8695eaac021253b8 2
10. FrameworkBHO64.dll 4da97e54e528d06ad242c7d4c39c8268 1
11. FrameworkEngine.exe 7f0768d924da2f3a417b91b453e4336f 1
12. FrameworkBHO64.dll f72f357aff645a1197e9a99b2c75f432 1
13. FrameworkEngine.exe 8c7263ab72046765502a1f8ecab08e30 1
14. FrameworkEngine.exe 954d98f8692284181f144fa156eff839 1
15. FrameworkBHO.dll b194ebed368a0775b6f2adb19e091664 1
16. FrameworkEngine.exe 5f509c0b59c447bd872ca6b8eda36776 1
17. FrameworkBHO.dll d4e97ef83987c7abdd2a2d599a66819e 1
18. FrameworkBHO.dll 030abc4d0bace55a7ce072d03d5bc784 1
19. FrameworkBHO64.dll a9a0cd024c72c7ac94352c0ec9c9ffdf 1
20. FrameworkBHO.dll 4aadf54a9f01d13ff494d1854e8bda85 1
21. FrameworkBHO64.dll 4b80f9a636066cfa1b900113b90e6d3b 1
22. FrameworkBHO.dll 8ab91db214b525494e774891541911e6 1
23. FrameworkBHO.dll b66caa26b98413526ff4ff002ca435f2 1
24. FrameworkBHO64.dll f6df8a9fb0558a1621c9fa6541f8f838 1
25. FrameworkBHO.dll 074d6eee5a25f21ce15add0f50f8f0dd 1
26. FrameworkBHO64.dll 75368d4ca8eb32e83cca1c041dd6aaab 1
27. FrameworkEngine.exe 87cb5b97cbb8c607cf0fccb795bd54d7 1
More files

Registry Details

Savings Wizard may create the following registry entry or registry entries:
CLSID
{39B931CF-F1E2-4D04-8129-9EE8159A91C5}
{41994F48-3EBD-4921-A3FC-A7886C6205B8}
{5682CA62-1A80-40AE-82A0-B67833CE75FF}
{CE7FAE28-E04D-496F-B56B-CD9E40998548}
{CEADAE6E-E08C-4950-BEBF-149EFD998248}
{E7574A3D-0F2D-478D-85F3-9224D7B230EA}
Software\Microsoft\Internet Explorer\Approved Extensions\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39B931CF-F1E2-4D04-8129-9EE8159A91C5}
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Savings Wizard
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Savings Wizard-repairJob
SOFTWARE\Savings Wizard
Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5682CA62-1A80-40AE-82A0-B67833CE75FF}
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Savings Wizard
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Savings Wizard-repairJob
SOFTWARE\Wow6432Node\Savings Wizard

Directories

Savings Wizard may create the following directory or directories:

%LOCALAPPDATA%\Savings Wizard
%ProgramFiles%\Savings Wizard
%ProgramFiles(x86)%\Savings Wizard

URLs

Savings Wizard may call the following URLs:

Savings Wizard

Trending

Most Viewed

Loading...