New malware attack: MySafeSavings.exe
avatar
KommissarReb (SW12) Rep. 2362
#1   28 May 2016
Earlier today my brother was downloading maps for Minecraft Demo from what I'll guess is a website arousing suspicion. I just got on my computer and have been dealing with undeletable adware called "mysafesavings.exe". I can't delete or uninstall it because its always running, and every time I try to close it with task manager it immediately starts up again in less than a second. I am using Windows 10.

I have since deleted the Minecraft demo and everything he downloaded, tried changing the permissions of the files in SafeSavings folder in ProgramData by changing the data in its backup file with gibberish, and its still running itself!

Does anyone else have experience with this malware? Does anyone have any clue what I can do to get rid of this bastardization of adware? Thanks in advance.

avatar
Tig Rep. 1652
#2   28 May 2016
Try some of the stuff here: www.reddit.com/r/m..._be_removed_by/

Here are the steps to do it manually:


Reboot into Safe Mode: stackoverflow.com/a/12692664/550975

Delete these folders:
C:\Program Files (x86)\SafeSavings
C:\ProgramData\SafeSavings\
C:\ProgramData\Microsoft\Windows\WindowsAccManager

Run regedit (Ctrl+Alt+Delete, Task Manager, File, Run, regedit):
Delete Folder: HKEY_CURRENT_USER\SOFTWARE\MySafeSavings
Delete Folder: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MySafeSavings
Delete Folder: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\MySafeSavings
Delete Folder: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\smass (ignore error, if any)

If any of the above locations are missing on your setup, see some of the other possibilities here: www.enigmasoftware...avings-removal/

Go back to normal windows mode: See the first link, basically type this into CMD (Command Prompt) bcdedit /deletevalue {current} safeboot

That should be it.

avatar
PaN61 Rep. 385
#3   28 May 2016
You can try running a full virus scan to check what type of virus it is (if it even shows up) or if there are possibly multiples of them that you may not know about and remove them this way. Otherwise if all else fails, a reformat is your best option.
avatar
KommissarReb (SW12) Rep. 2362
#4   29 May 2016
I can't delete any of those folders because the programs are running. When a program is running, you can't do anything to it.
avatar
Tig Rep. 1652
#5   29 May 2016
You have to boot into safe mode first.
avatar
KommissarReb (SW12) Rep. 2362
#6   29 May 2016
I think I may have gotten rid of it, but I'm not sure if it was the result of me installing MalwareBytes.

The computer was lagging and I opened Task Manager again try again to stop mysafesavings.exe from running long enough for me to edit the ".exe" to something else.

I think it worked. When I did that it couldn't reactivate itself because I made it an unopenable type of file the trojan couldn't recognize fast enough during the lag. The computer lagging was one of its weapons, but it looks like its evil plot backfired.

avatar
Tig Rep. 1652
#7   03 Jun 2016
Just curious. Did you manage to remove the malware?
avatar
KommissarReb (SW12) Rep. 2362
#8   03 Jun 2016
Its my father's computer, so just how much stuff on it I'm allowed to change is limited. Its ultimately up to him to do scans with the anti-virus program he uses, as well as what stays and goes.
avatar
CZghost Rep. 1681
#9   26 Jun 2016
Ask your father to do such steps. If nothing helps or father is like stubborn and won't allow, ask him to actually reinstall Windows or give it to repair. You might want to again upgrade to Windows 10 if you decide to reinstall Windows (or give your computer to the repair service). As an user I couldn't recommend to upgrade to Windows 10. It's full of bugs and actually it can run you out of data tariff really fast as it is heavily posting telemetry data to Microsoft servers while computer idle. And even when you deny all the available telemetry data, you have no way to control ALL the telemetry data and the computer can get switched to the full telemetry again if Microsoft decides to do so. I don't say that earlier versions of Windows don't do the same, but actually they don't in such way. For your brother, I'd recommend you to take control over him and actually don't leave him alone on the computer, if he's like downloading trojans and installing adware.
avatar
KommissarReb (SW12) Rep. 2362
#10   26 Jun 2016
@CZghost: I tried convincing him not to install Windows 10 in the first place, and he's adamant about keeping it. He had Trend Micro wipe out pretty much everything under the Sun on the computer save for the bare essentials that allow it to function. He won't let me use it anymore after that happened, so I really couldn't care less at this point as that computer is his problem now.

The only computer I can still play Q3 on now is our 15 year old Dell desktop that's slow as molasses until I get the computer in my room fixed or replaced.

avatar
Burton Rep. 0
#11   21 Dec 2016
Sometime you have to use other programs to remove these problems. It is unnecessary to reinstall the whole system for merely fixing a malware problem. Do you check the browser for any strange browser extensions that need to be disabled or removed? You can read the free multi-step removal guide to see what else you can do if you can't install the other program on that computer.
guides.uufix.com/h...fe-savings-ads/

Only registered members can post a reply.
Already registered? Sign in.

kritische_masse
Clear