What is NeWSavver?

NeWSavver is software application developed by InstalleRex-WebPick. It is most commonly found on computers running Windows 7 with nearly 50.00% of installations running this operating system. NeWSavver's installer is typically 1.00 MB in size and installs around 15 files.

NeWSavver is most popular in the United States with 55.44% of installations residing in this country.

About NeWSavver?

Introducing New Saver, a browser extension designed to enhance the user's online experience by displaying additional advertisements in popular search engines such as Bing and Google. Compatible with Internet Explorer, Chrome, and Firefox, this adware program seamlessly integrates as a background process and creates an entry in Add or Remove Programs for easy management. Although removing the program may halt its operation, advertisements may still persist. New Saver utilizes the InstalleRex download manager from WebPicks Holdings for installation, a known distributor of potentially unwanted applications and ad-supported extensions. With its ability to inject new ads into search results and web pages, New Saver aims to provide users with targeted and relevant advertising content.

Multiple virus scanners have detected malware in NeWSavver.

4.exe (MD5: f5bff621c4c58358b36f8526dec8a264) has been flagged by 39 scanners:

Scanner Software	Version	Result
Agnitum Outpost	7.1.1	Adware.MegaSearch
AhnLab-V3	2014.01.06	Trojan/Win32.Preloader
Antiy-AVL	2.0.3.7	AdWare/Win32.MegaSearch
avast!	2014.9-140126	Win32:Adware-gen [Adw]
AVG	2015.0.3582	Generic5
Baidu-International	4.0.3.14126	Adware.Win32.MegaSearch.aBc
Bkav FE	1.3.0.4613	W32.Clod3fd.Trojan
Comodo Security	17558	ApplicUnwnt
ESET-NOD32	8.9255	a variant of Win32/AdWare.MultiPlug.K.gen
Fortinet FortiGate	1/26/2014	Adware/Megasearch
IKARUS anti.virus	t3scan.2.2.29	Win32.AdWare
K7 AntiVirus	13.175.10735	Adware
K7GW	13.175.10735	Adware ( 00490ca81 )
Kaspersky	14.0.0.4407	not-a-virus:AdWare.Win32.MegaSearch
Kingsoft AntiVirus	331020.49267	Win32.Troj.MegaSearch.at.(kcloud)
Malwarebytes	v2014.01.26.03	PUP.Optional.CRXDrop.A
McAfee	5600.7238	Artemis!F5BFF621C4C5
McAfee-GW-Edition	7.7238	Artemis!F5BFF621C4C5
Panda Antivirus	14.01.26.03	Trj/Genetic.gen
Sophos	4.96	Generic PUA BJ
Symantec	1/26/2014 rev. 1	Trojan.Gen
Trend Micro	10.465.26	TROJ_GEN.F0C2C00A414
TrendMicro-HouseCall	7.2.26	TROJ_GEN.F0C2C00A414
Vba32 AntiVirus	3.12.24.3	BScope.Trojan.Agent
VIPRE Antivirus	25126	Trojan.Win32.Generic!BT
Lavasoft Ad-Aware	12.0.163.0	Gen:Variant.Adware.Graftor.146103
Avira AntiVir	7.11.165.68	Adware/Graftor.146103
AVware	1.5.0.16	Trojan.Win32.Generic!BT
Bitdefender	7.2	Gen:Variant.Adware.Graftor.146103
CAT-QuickHeal	14.00	AdWare.MultiPlug.r5 (Not a Virus)
Emsisoft Anti-Malware	3.0.0.600	Gen:Variant.Adware.Graftor.146103 (B)
F-Secure	11.0.19100.45	Gen:Variant.Adware.Graftor.146103
G Data	24	Gen:Variant.Adware.Graftor.146103
MicroWorld-eScan	12.0.250.0	Gen:Variant.Adware.Graftor.146103
NANO AntiVirus	0.28.2.61349	Riskware.Win32.Graftor.dcodwf
Tencent	1.0.0.1	Win32.Risk.Adware.Dzkd
Qihoo-360	1.0.0.1015	Win32/Trojan.Adware.814
Rising Antivirus	25.0.0.11	PE:Malware.Adware!6.1293
SUPERAntiSpyware	5.6.0.1032	Adware.Multiplug/Variant

gunJkOem.dll (MD5: 98e78357d0a423420fb17dc09212e741) has been flagged by 24 scanners:

Scanner Software	Version	Result
AhnLab-V3	None	Adware/Win32.Graftor
Avira AntiVir	7.11.141.42	ADWARE/Adware.Gen
AVG	13.0.0.3169	Generic_r.GU
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.N
Comodo Security	18043	ApplicUnwnt.Win32.InstallRex.ALC
ESET-NOD32	9634	a variant of Win32/AdWare.MultiPlug.N
G Data	24	Win32.Trojan.Multiplug.A
Malwarebytes	1.75.0001	PUP.Optional.MultiPlug.A
McAfee	6.0.4.564	Adware-FHP
McAfee-GW-Edition	2013	Adware-FHP
Qihoo-360	1.0.0.1015	Malware.QVM30.Gen
Rising Antivirus	25.0.0.11	PE:Malware.Adware!6.1293
Sophos	4.98.0	MultiPlug
SUPERAntiSpyware	5.6.0.1032	Adware.Multiplug/Variant
Symantec	20131.1.5.61	WS.Reputation.1
VIPRE Antivirus	28004	JustPlugIt (fs)
AVware	1.5.0.16	Trojan.Win32.Generic!BT
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.R0C9H06GB14
avast!	8.0.1489.320	Win64:Malware-gen
IKARUS anti.virus	T3.1.6.1.0	PUA.Multiplug
K7 AntiVirus	9.175.10807	Adware ( 004923a41 )
K7GW	9.175.10807	Adware ( 004923a41 )
Kaspersky	12.0.0.1225	not-a-virus:AdWare.Win32.MultiPlug.bfk

4.x64.dll (MD5: 9e0383fb82ce83bd785951c20f3fe959) has been flagged by 4 scanners:

Scanner Software	Version	Result
AhnLab-V3	2013.12.31.00	Trojan/Win32.Preloader
Baidu-International	3.5.1.41473	Adware.Win64.MultiPlug.A
ESET-NOD32	9234	a variant of Win64/Adware.MultiPlug.A
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A

4.dll (MD5: 1550537f5aee53fec3b74eb4605f8483) has been flagged by 18 scanners:

Scanner Software	Version	Result
Avira AntiVir	7.11.124.160	ADWARE/Adware.Gen
AVG	13.0.0.3169	Generic5.ALFJ
Baidu-International	3.5.1.41473	Adware.Win32.MultiPlug.40
Comodo Security	17589	ApplicUnwnt
ESET-NOD32	9277	a variant of Win32/AdWare.MultiPlug.N
K7 AntiVirus	9.175.10807	Adware ( 004923a41 )
K7GW	9.175.10807	Adware ( 004923a41 )
Malwarebytes	1.75.0.1	PUP.Optional.MultiPlug.A
Rising Antivirus	25.0.0.11	PE:Malware.Adware!6.1293
TrendMicro-HouseCall	9.700.0.1001	TROJ_GEN.F47V1230
VIPRE Antivirus	25302	JustPlugIt (fs)
AhnLab-V3	2014.07.16.00	Trojan/Win32.Preloader
Fortinet FortiGate	5.1.152.0	Riskware/MultiPlug
McAfee	6.0.4.564	RDN/Generic PUP.x!c2a
McAfee-GW-Edition	2013	RDN/Generic PUP.x!c2a
Sophos	4.98.0	Generic PUA AO
Kaspersky	12.0.0.1225	not-a-virus:AdWare.Win32.MultiPlug.bfk
IKARUS anti.virus	T3.1.6.1.0	PUA.Multiplug

xA3zGfJWm4.x64.dll (MD5: 9b44cf590f064eaf267c2fe11a2f6d7a) has been flagged by 9 scanners:

Scanner Software	Version	Result
AhnLab-V3	2014.08.07.00	Trojan/Win64.Preloader
AVG	14.0.0.3986	Generic_r.QB
Baidu-International	3.5.1.41473	Trojan.Win64.MultiPlug.BD
ESET-NOD32	10216	a variant of Win64/Adware.MultiPlug.D
IKARUS anti.virus	T3.1.6.1.0	PUA.Multiplug
Malwarebytes	1.75.0.1	PUP.Optional.Preload
McAfee	6.0.4.564	Artemis!9B44CF590F06
McAfee-GW-Edition	2013.2	Artemis!9B44CF590F06
TrendMicro-HouseCall	9.700.0.1001	Suspicious_GEN.F47V0702

Software Details

URL:

https://justplug.it

Support:

–

Installation path:

C:\ProgramData\newsavver

Uninstaller:

"C:\ProgramData\NeWSavver\4.exe" /s /n /C:"ExecuteCommands;UninstallCommands" ""

Size:

1.00 MB

Language:

English

NeWSavver Executable Details

Primary executable:

4.exe

Name:

NeWSavver

Path:

C:\ProgramData\newsavver\4.exe

MD5:

f5bff621c4c58358b36f8526dec8a264

SHA-1:

–

SHA-256:

–

File Type

Filename

MD5

DLL

zIMVdVdAe.dll

Adware

938a58a18228d9c556965deb4f74e494

DLL

heaAzw_xUx.x64.dll

Adware

2399176cdc9056ed5fc364c12b555b23

DLL

heaAzw_xUx.dll

Malware

5337ab32d06451b51b031fad03674a73

EXE

gunJkOem.exe

416131e8f4bfc325b60b7e87960df6ca

EXE

xA3zGfJWm4.exe