Content is republished with permission from Malwarebytes.
What is Savings Wave?
The Malwarebytes research team has determined that Savings Wave is a browser hijacker. These so-called "hijackers" alter your startpage or searchscopes so that the effected browser visits their site or one of their choice. This one also displays advertisements.
How do I know if my computer is affected by Savings Wave?
You may see these browser extensions/add-ons:
and this entry in your list of installed programs:
How did Savings Wave get on my computer?
Browser hijackers use different methods for distributing themselves. This particular one was bundled with other software.
How do I remove Savings Wave?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.
Is there anything else I need to do to get rid of Savings Wave?
How would the full version of Malwarebytes Anti-Malware help protect me?
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Savings Wave rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.
Technical details for experts
Signs in a HijackThis log:
O2 - BHO: CrossriderApp0012765 - {11111111-1111-1111-1111-110111271165} - C:\Program Files\Savings Wave\Savings Wave-bho.dll
Alterations made by the installer:
File system details
---------------------------------------------
Adds the folder C:\Program Files\Savings Wave
Adds the file background.html"="8/8/2013 10:30 AM, 740 bytes, A
Adds the file Installer.log"="4/5/2014 3:48 PM, 165836 bytes, A
Adds the file Savings Wave.ico"="8/8/2013 10:30 AM, 9662 bytes, A
Adds the file Savings Wave-bg.exe"="4/5/2014 3:48 PM, 899960 bytes, A
Adds the file Savings Wave-bho.dll"="4/5/2014 3:48 PM, 751992 bytes, A
Adds the file Savings Wave-buttonutil.dll"="4/5/2014 3:48 PM, 397176 bytes, A
Adds the file Savings Wave-buttonutil.exe"="4/5/2014 3:48 PM, 342392 bytes, A
Adds the file Savings Wave-buttonutil64.dll"="4/5/2014 3:48 PM, 477048 bytes, A
Adds the file Savings Wave-buttonutil64.exe"="4/5/2014 3:48 PM, 446840 bytes, A
Adds the file Savings Wave-codedownloader.exe"="4/5/2014 3:48 PM, 480632 bytes, A
Adds the file Savings Wave-helper.exe"="4/5/2014 3:48 PM, 315768 bytes, A
Adds the file Uninstall.exe"="4/5/2014 3:48 PM, 492314 bytes, A
Adds the folder C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lglkfgcmohcdajpldlnhjjiojjgkbmhm_0
Adds the file 1"="4/5/2014 3:48 PM, 7168 bytes, A
Adds the folder C:\Users\{username}\AppData\Local\Savings Wave\Chrome
Adds the file 12765.xml"="4/5/2014 3:48 PM, 307 bytes, A
Adds the file Savings Wave.crx"="4/5/2014 3:48 PM, 156314 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]
Adds the file chrome.manifest"="8/8/2013 8:30 AM, 402 bytes, A
Adds the file install.rdf"="8/8/2013 8:30 AM, 1185 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content
Adds the file api.js"="8/8/2013 8:30 AM, 18192 bytes, A
Adds the file background.html"="8/8/2013 8:30 AM, 2001 bytes, A
Adds the file baseObject.js"="8/8/2013 8:30 AM, 19 bytes, A
Adds the file browser.xul"="8/8/2013 8:30 AM, 3321 bytes, A
Adds the file dialog.js"="8/8/2013 8:30 AM, 1343 bytes
Adds the file main.js"="8/8/2013 8:30 AM, 27352 bytes, A
Adds the file options.js"="8/8/2013 8:30 AM, 1931 bytes, A
Adds the file options.xul"="8/8/2013 8:30 AM, 1803 bytes, A
Adds the file search_dialog.xul"="8/8/2013 8:30 AM, 2402 bytes
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api
Adds the file asyncDB.js"="8/8/2013 8:30 AM, 4606 bytes, A
Adds the file background.js"="8/8/2013 8:30 AM, 1078 bytes, A
Adds the file browserAction.js"="8/8/2013 8:30 AM, 6731 bytes, A
Adds the file contextMenu.js"="8/8/2013 8:30 AM, 4980 bytes, A
Adds the file dbManager.js"="8/8/2013 8:30 AM, 4988 bytes, A
Adds the file dom_bg.js"="8/8/2013 8:30 AM, 1892 bytes, A
Adds the file fileManager.js"="8/8/2013 8:30 AM, 848 bytes, A
Adds the file firefox.js"="8/8/2013 8:30 AM, 258 bytes, A
Adds the file firefoxNotifications.js"="8/8/2013 8:30 AM, 1021 bytes, A
Adds the file firefoxOmnibox.js"="8/8/2013 8:30 AM, 1327 bytes, A
Adds the file message.js"="8/8/2013 8:30 AM, 2733 bytes, A
Adds the file pageAction.js"="8/8/2013 8:30 AM, 8935 bytes, A
Adds the file request.js"="8/8/2013 8:30 AM, 2219 bytes, A
Adds the file tabs.js"="8/8/2013 8:30 AM, 2565 bytes, A
Adds the file webRequest.js"="8/8/2013 8:30 AM, 1066 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core
Adds the file console.js"="8/8/2013 8:30 AM, 1658 bytes, A
Adds the file consts.js"="8/8/2013 8:30 AM, 1440 bytes, A
Adds the file delegate.js"="8/8/2013 8:30 AM, 1963 bytes, A
Adds the file httpObserver.js"="8/8/2013 8:30 AM, 2561 bytes, A
Adds the file IDBWrapper.js"="8/8/2013 8:30 AM, 4073 bytes, A
Adds the file installer.js"="8/8/2013 8:30 AM, 581 bytes, A
Adds the file pluginsManager.js"="8/8/2013 8:30 AM, 3910 bytes, A
Adds the file prefs.js"="8/8/2013 8:30 AM, 1499 bytes, A
Adds the file progressListenerObserver.js"="8/8/2013 8:30 AM, 1476 bytes, A
Adds the file registry.js"="8/8/2013 8:30 AM, 1063 bytes, A
Adds the file reloadObserver.js"="8/8/2013 8:30 AM, 255 bytes, A
Adds the file reports.js"="8/8/2013 8:30 AM, 3488 bytes, A
Adds the file requestObject.js"="8/8/2013 8:30 AM, 1181 bytes, A
Adds the file searchSettings.js"="8/8/2013 8:30 AM, 3371 bytes, A
Adds the file uninstallObserver.js"="8/8/2013 8:30 AM, 2067 bytes, A
Adds the file updateManager.js"="8/8/2013 8:30 AM, 9039 bytes, A
Adds the file utils.js"="8/8/2013 8:30 AM, 8770 bytes, A
Adds the file xhr.js"="8/8/2013 8:30 AM, 2701 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\extensionCode
Adds the file backgroundCode.js"="8/8/2013 8:30 AM, 1 bytes, A
Adds the file pageCode.js"="8/8/2013 8:30 AM, 1 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\defaults\preferences
Adds the file prefs.js"="8/8/2013 8:30 AM, 1833 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData
Adds the file manifest.xml"="8/8/2013 8:30 AM, 1696 bytes, A
Adds the file plugins.json"="8/8/2013 8:30 AM, 4314 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins
Adds the file 1_base.js"="8/8/2013 8:30 AM, 6696 bytes, A
Adds the file 1000014_GPL Plugin (Loader).js"="8/8/2013 8:30 AM, 12543 bytes, A
Adds the file 1000015_GPL Background (BG).js"="8/8/2013 8:30 AM, 19411 bytes, A
Adds the file 13_CrossriderAppUtils.js"="8/8/2013 8:30 AM, 5955 bytes, A
Adds the file 14_CrossriderUtils.js"="8/8/2013 8:30 AM, 12369 bytes, A
Adds the file 16_FFAppAPIWrapper.js"="8/8/2013 8:30 AM, 12462 bytes, A
Adds the file 17_jQuery.js"="8/8/2013 8:30 AM, 79982 bytes, A
Adds the file 21_debug.js"="8/8/2013 8:30 AM, 3644 bytes, A
Adds the file 22_resources.js"="8/8/2013 8:30 AM, 9082 bytes, A
Adds the file 28_initializer.js"="8/8/2013 8:30 AM, 664 bytes, A
Adds the file 4_jquery_1_7_1.js"="8/8/2013 8:30 AM, 94180 bytes, A
Adds the file 47_resources_background.js"="8/8/2013 8:30 AM, 7720 bytes, A
Adds the file 64_appApiMessage.js"="8/8/2013 8:30 AM, 2332 bytes, A
Adds the file 72_appApiValidation.js"="8/8/2013 8:30 AM, 23223 bytes, A
Adds the file 78_CrossriderInfo.js"="8/8/2013 8:30 AM, 2467 bytes, A
Adds the file 98_omniCommands.js"="8/8/2013 8:30 AM, 1712 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\userCode
Adds the file background.js"="8/8/2013 8:30 AM, 3 bytes, A
Adds the file extension.js"="8/8/2013 8:30 AM, 203 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\locale
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\locale\en-US
Adds the file translations.dtd"="8/8/2013 8:30 AM, 425 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin
Adds the file button1.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file button2.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file button3.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file button4.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file button5.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file crossrider_statusbar.png"="8/8/2013 8:30 AM, 1361 bytes, A
Adds the file icon128.png"="8/8/2013 8:30 AM, 5858 bytes, A
Adds the file icon16.png"="8/8/2013 8:30 AM, 1114 bytes, A
Adds the file icon24.png"="8/8/2013 8:30 AM, 3030 bytes, A
Adds the file icon48.png"="8/8/2013 8:30 AM, 5613 bytes, A
Adds the file panelarrow-up.png"="8/8/2013 8:30 AM, 917 bytes, A
Adds the file popup.html"="8/8/2013 8:30 AM, 349 bytes, A
Adds the file skin.css"="8/8/2013 8:30 AM, 715 bytes, A
Adds the file update.css"="8/8/2013 8:30 AM, 140 bytes, A
In the existing folder C:\Windows\System32\Tasks
Adds the file Updater12765.exe"="4/5/2014 3:48 PM, 3788 bytes, A
Registry details
------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}]
"(Default)"="REG_SZ", "Savings Wave"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}\InprocServer32]
"(Default)"="REG_SZ", "C:\Program Files\Savings Wave\Savings Wave-bho.dll"
"ThreadingModel"="REG_SZ", "Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}\ProgID]
"(Default)"="REG_SZ", "CrossriderApp0012765.BHO.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}\Programmable]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}\TypeLib]
"(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144274465}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110111271165}\VersionIndependentProgID]
"(Default)"="REG_SZ", "CrossriderApp0012765"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}\InprocServer32]
"(Default)"="REG_SZ", "C:\Program Files\Savings Wave\Savings Wave-bho.dll"
"ThreadingModel"="REG_SZ", "Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}\ProgID]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}\Programmable]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}\TypeLib]
"(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144274465}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220122272265}\VersionIndependentProgID]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.BHO]
"(Default)"="REG_SZ", "CrossriderApp0012765"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.BHO\CLSID]
"(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111271165}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.BHO\CurVer]
"(Default)"="REG_SZ", "CrossriderApp0012765"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.BHO.1]
"(Default)"="REG_SZ", "CrossriderApp0012765"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.BHO.1\CLSID]
"(Default)"="REG_SZ", "{11111111-1111-1111-1111-110111271165}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.Sandbox]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.Sandbox\CLSID]
"(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122272265}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.Sandbox\CurVer]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.Sandbox.1]
"(Default)"="REG_SZ", "CrossriderApp0012765.Sandbox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0012765.Sandbox.1\CLSID]
"(Default)"="REG_SZ", "{22222222-2222-2222-2222-220122272265}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155275565}]
"(Default)"="REG_SZ", "ICrossriderBHO"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155275565}\ProxyStubClsid]
"(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155275565}\ProxyStubClsid32]
"(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550155275565}\TypeLib]
"(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144274465}"
"Version"="REG_SZ", "1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166276665}]
"(Default)"="REG_SZ", "ISandBox"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166276665}\ProxyStubClsid]
"(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166276665}\ProxyStubClsid32]
"(Default)"="REG_SZ", "{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660166276665}\TypeLib]
"(Default)"="REG_SZ", "{44444444-4444-4444-4444-440144274465}"
"Version"="REG_SZ", "1.0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144274465}\1.0]
"(Default)"="REG_SZ", "CrossriderApp0012765 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144274465}\1.0\0\win32]
"(Default)"="REG_SZ", "C:\Program Files\Savings Wave\Savings Wave-bho.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144274465}\1.0\FLAGS]
"(Default)"="REG_SZ", "0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440144274465}\1.0\HELPDIR]
"(Default)"="REG_SZ", "C:\Program Files\Savings Wave"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{04e67525-320c-4e62-a25f-7d50b671ec76}
"AppName"="REG_SZ", "Savings Wave-helper.exe"
"AppPath"="REG_SZ", "C:\Program Files\Savings Wave"
"Policy"="REG_DWORD", 3
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110111271165}]
"(Default)"="REG_SZ", "CrossriderApp0012765"
"NoExplorer"="REG_DWORD", 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271165}]
"(Default)"="REG_SZ", ""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Savings Wave]
"CrAppId"="REG_SZ", "12765"
"CrPublisherId"="REG_SZ", "390"
"DisplayIcon"="REG_SZ", "C:\Program Files\Savings Wave\Uninstall.exe"
"DisplayName"="REG_SZ", "Savings Wave"
"DisplayVersion"="REG_SZ", "1.27.153.11"
"Publisher"="REG_SZ", "Innovative Apps"
"UninstallString"="REG_SZ", "C:\Program Files\Savings Wave\Uninstall.exe /fromcontrolpanel=1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Savings Wave\Installer]
"BundledChrome"="REG_DWORD", 1
"BundledFirefox"="REG_DWORD", 1
"BundledIe"="REG_DWORD", 1]
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271165}]
"(Default)"="REG_SZ", ""
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider]
"215AppVerifier"="REG_SZ", "93a87d09a3aabd2d5cffe42b01baed79"
"Bic"="REG_SZ", "58FA9CEE80514E1397A962B2D7F1DC3AIE"
"Verifier"="REG_SZ", "5a4a73021e5b984a9a0f95d928813179"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave]
"ActiveAppId"="REG_SZ", "12765"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Agent]
"ErrorsDomain"="REG_SZ", "http://errors.ourdatasrv.com"
"JsonDomain"="REG_SZ", "http://update.ourdatasrv.com"
"StatsDomain"="REG_SZ", "http://stats.ourdatasrv.com"
"Version"="REG_SZ", "1"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Code]
"AppJavaScript"="REG_SZ", "if("undefined"!=typeof _GPL_PLUGIN){var _GPL_=function()"
"NewTabJavaScript"="REG_SZ", ""
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Installer]
"CodeDownloadDomain"="REG_SZ", "http://app-static.crossrider.com"
"Domain"="REG_SZ", "http://app-static.crossrider.com"
"ErrorsDomain"="REG_SZ", "http://errors.ourdatasrv.com"
"FullVersion"="REG_SZ", "1.27.153.11"
"FullVersionForUrl"="REG_SZ", "1_27_153"
"MinorVersion"="REG_SZ", "11"
"Params"="REG_SZ", "{"source_id" : "327230", "sub_id" : "default", "uzid" : "327230&subid=&pid=1618"}"
"PlatformVersion"="REG_SZ", "1"
"ScriptVersion"="REG_SZ", "27"
"SetHomepage"="REG_SZ", "false"
"SetNewTab"="REG_SZ", "false"
"SetSearch"="REG_SZ", "false"
"SoftwareDetected"="REG_SZ", "{"AnySoftware":false,"Wireshark":false,"VirtualBox":false,"VMWare":false,"InsideVM":true,"InsideVMWare":false,"InsideVirtualBox":true,"InsideVirtualPc":false}"
"SrcId"="REG_SZ", "327230"
"StatsDomain"="REG_SZ", "http://stats.ourdatasrv.com"
"SubId"="REG_SZ", "default"
"ThankYouPage"="REG_SZ", "true"
"Time"="REG_SZ", "1396705692"
"UserConfirmation"="REG_SZ", "false"
"ZData"="REG_SZ", "327230&subid=&pid=1618"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Log]
"savings wave-bho"="REG_DWORD", 0
"savings wave-helper"="REG_DWORD", 0
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Manifest]
"AddressbarURL"="REG_SZ", "NA"
"BgVersion"="REG_SZ", "42"
"ChangePrevious"="REG_SZ", "false"
"Description"="REG_SZ", "Savings Wave"
"DisableIe"="REG_SZ", "true"
"EnableSearchIE"="REG_SZ", "false"
"HomePageUrl"="REG_SZ", "NA"
"IsButtonEnabled"="REG_SZ", "false"
"Manifest"="REG_SZ", "NA"
"ModeType"="REG_SZ", "production"
"Name"="REG_SZ", "Savings Wave"
"PluginsManifestVersion"="REG_SZ", "65"
"PublisherId"="REG_SZ", "390"
"PublisherName"="REG_SZ", "Innovative Apps"
"RunInFrame"="REG_SZ", "false"
"SetNewTab"="REG_SZ", "false"
"ThanksUrl"="REG_SZ", "NA"
"UninstallerOfferAction"="REG_SZ", "NA"
"UninstallerOfferUrl"="REG_SZ", "NA"
"UpdateInterval"="REG_DWORD", 360
"Version"="REG_SZ", "71"
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Plugins]
"AppPluginList"="REG_SZ", "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,182,183,72,177,1000014,28"
"BgPluginList"="REG_SZ", "42,38,46,41,44,39,35,43,36,4,14,78,64,183,47,182,72,1000015"
"BrowserEventPluginList"="REG_SZ", "14,42,41,44,39,38,43,37,64,72"
"NewTabPluginList"="REG_SZ", "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,72,28"
"OnRequestPluginList"="REG_SZ", "14,42,41,39,38,43,45,64,72"
"PopupPluginList"="REG_SZ", "42,38,46,41,44,39,35,43,36,4,14,78,13,64,47,182,72,94"
{"Javascript pkugins removed, full log available by request"}
[HKEY_CURRENT_USER\Software\AppDataLow\Software\Savings Wave\Update]
"LastCheck"="REG_DWORD", 1396705697
[HKEY_CURRENT_USER\Software\Cr_Installer\12765]
"InstallationThankYouPage"="REG_DWORD", 1
"InstallationTime"="REG_DWORD", 1396705692
"InstallationUserSettings"="REG_SZ", "{"searchUserConifrmation": false, "setSearch": false, "setHomepage": false, "setNewTab": false}"
"InstallerIdentifiers"="REG_SZ", "{"installer_bic" : "58FA9CEE80514E1397A962B2D7F1DC3AIE", "installer_verifier" : "5a4a73021e5b984a9a0f95d928813179", "installer_verifier_for_215app" : "93a87d09a3aabd2d5cffe42b01baed79"}"
"InstallerParams"="REG_SZ", "{"source_id" : "327230", "sub_id" : "default", "uzid" : "327230&subid=&pid=1618"}"
"SoftwareDetected"="REG_SZ", "{"AnySoftware":false,"Wireshark":false,"VirtualBox":false,"VMWare":false,"InsideVM":true,"InsideVMWare":false,"InsideVirtualBox":true,"InsideVirtualPc":false}"
[HKEY_CURRENT_USER\Software\InstalledBrowserExtensions\Innovative Apps]
"12765"="REG_SZ", "Savings Wave"
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 4/5/2014
Scan Time: 4:02:25 PM
Logfile: mbamSavingsWave.txt
Administrator: Yes
Version: 2.00.1.1004
Malware Database: v2014.04.05.03
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Disabled
Malicious Website Protection: Disabled
Chameleon: Disabled
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Malwarebytes
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 206767
Time Elapsed: 3 min, 30 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 22
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440144274465}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550155275565}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660166276665}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0012765.BHO.1, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0012765.BHO, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110111271165}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CLSID\{22222222-2222-2222-2222-220122272265}, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0012765.Sandbox.1, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CrossriderApp0012765.Sandbox, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\CLASSES\CLSID\{11111111-1111-1111-1111-110111271165}\INPROCSERVER32, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Savings Wave, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, HKLM\SOFTWARE\Savings Wave, Quarantined, [8433f72f136855e1f4019ac3986a9e62],
PUP.Optional.Ligtning.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\cekcjpgehmohobmdiikfnopibipmgnml, Quarantined, [486f7babcab142f40d30e78318eae917],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, Quarantined, [feb9a77fd5a659dd5d9cbddbac57b54b],
PUP.Optional.SavingsWave.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Savings Wave, Quarantined, [b3042402a1dadf577c77df7e9270639d],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CR_INSTALLER\12765, Quarantined, [bef9899d7308ef478af1e4a24bb831cf],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Innovative Apps, Quarantined, [7047c75fc1ba191d775a0a8308fb6d93],
Registry Values: 0
(No malicious items detected)
Folders: 22
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log, Quarantined, [8d2a21059be02d090d4c81e9768cf907],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Local\Updater12765, Quarantined, [d0e7cf572a5162d44316e17679892ad6],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected], Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\extensionCode, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\defaults, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\defaults\preferences, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\userCode, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\locale, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\locale\en-US, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lglkfgcmohcdajpldlnhjjiojjgkbmhm_0, Quarantined, [4473cb5b1665bd793aee72eba65cd22e],
PUP.Optional.SavingsWave.A, C:\Users\{username}\AppData\Local\Savings Wave, Quarantined, [82359e88c0bba98d33094716bc46c43c],
PUP.Optional.SavingsWave.A, C:\Users\{username}\AppData\Local\Savings Wave\Chrome, Quarantined, [82359e88c0bba98d33094716bc46c43c],
Files: 233
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-bho.dll, Quarantined, [922542e43d3e51e541e13235fb06c13f],
PUP.Optional.SavingsWave.A, C:\Users\{username}\Desktop\Savings wave (crossRider).exe, Quarantined, [0fa8ed39bbc076c0fe2489ded1308a76],
PUP.Optional.SavingsWave.A, C:\Users\{username}\AppData\Local\Updater12765\Updater12765.exe, Quarantined, [3c7b2ef8215a2f074fd3e48307faf808],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\background.html, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Installer.log, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-bg.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-buttonutil.dll, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-buttonutil.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-buttonutil64.dll, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-buttonutil64.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-codedownloader.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave-helper.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Savings Wave.ico, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.SavingsWave.A, C:\Program Files\Savings Wave\Uninstall.exe, Quarantined, [991e3fe7a9d24de928c95d00f60c32ce],
PUP.Optional.NewTab.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx, Quarantined, [6a4dd65098e32d09458e23474eb43ec2],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\background.html, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\background.js, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\data.json, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\icon128.png, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\jquery.js, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\manifest.json, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\xa.js, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.Lightning.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\xagainit.js, Quarantined, [a413d4524c2f290d55d29fb809f9cc34],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome.manifest, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\install.rdf, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\background.html, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\baseObject.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\browser.xul, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\dialog.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\main.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\options.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\options.xul, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\search_dialog.xul, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\asyncDB.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\background.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\browserAction.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\contextMenu.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\dbManager.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\dom_bg.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\fileManager.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\firefox.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\firefoxNotifications.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\firefoxOmnibox.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\message.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\pageAction.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\request.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\tabs.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\api\webRequest.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\console.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\consts.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\delegate.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\httpObserver.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\IDBWrapper.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\installer.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\pluginsManager.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\prefs.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\progressListenerObserver.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\registry.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\reloadObserver.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\reports.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\requestObject.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\searchSettings.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\uninstallObserver.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\updateManager.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\utils.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\core\xhr.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\extensionCode\backgroundCode.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\chrome\content\extensionCode\pageCode.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\defaults\preferences\prefs.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\manifest.xml, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins.json, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\1000014_GPL Plugin (Loader).js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\1000015_GPL Background (BG).js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\13_CrossriderAppUtils.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\14_CrossriderUtils.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\16_FFAppAPIWrapper.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\17_jQuery.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\1_base.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\21_debug.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\22_resources.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\28_initializer.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\47_resources_background.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\4_jquery_1_7_1.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\64_appApiMessage.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\72_appApiValidation.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\78_CrossriderInfo.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\plugins\98_omniCommands.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\userCode\background.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\extensionData\userCode\extension.js, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\locale\en-US\translations.dtd, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\button1.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\button2.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\button3.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\button4.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\button5.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\crossrider_statusbar.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\icon128.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\icon16.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\icon24.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\icon48.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\panelarrow-up.png, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\popup.html, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\skin.css, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossFire.A, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\joxsq3f5.default\extensions\[email protected]\skin\update.css, Quarantined, [2196af77a9d2ae88042aa1b96f937f81],
PUP.Optional.CrossRider.A, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_lglkfgcmohcdajpldlnhjjiojjgkbmhm_0\1, Quarantined, [4473cb5b1665bd793aee72eba65cd22e],
PUP.Optional.SavingsWave.A, C:\Users\{username}\AppData\Local\Savings Wave\Chrome\12765.xml, Quarantined, [82359e88c0bba98d33094716bc46c43c],{"javascript removed, full log available by request"}
PUP.Optional.SavingsWave.A, C:\Users\{username}\AppData\Local\Savings Wave\Chrome\Savings Wave.crx, Quarantined, [82359e88c0bba98d33094716bc46c43c],
Physical Sectors: 0
(No malicious items detected)
(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
Save yourself the hassle and get protected.
Back to top
Sign In
Create Account
