saFeweb

SaferWeb is a web browser extension developed by JustPlug.It. It is commonly distributed through the WebPick InstalleRex download and install manager. The extension has been reported to be included in adware offer bundles as well. Once installed, the SaferWeb extension has multiple components, including a Windows service, an auto-starting component, and a browser toolbar/plugin. These components are designed to inject various forms of advertisements into the browser, such as banner ads, hyper-text links, and pop-ups. In some versions, the extension may also hijack existing advertising on websites and inject affiliate codes in links as coupon offers. During installation, the program will create a folder with a random name in either Program Files or ProgramData, and each included file will also have a shared randomly generated name. The Windows Service that is installed runs with full administrator rights under the Services control app and connects to remote servers for updates. Additionally, some versions create a server that listens for TCP network requests locally. The advertisements displayed in the browser may include deceptive malvertising ads for 'required' updates of common programs, as well as unwanted pop-up advertisements. Users should be cautious as downloading these programs may result in the installation of bundled adware utilities and additional browser extensions. Furthermore, components of the program may modify the browser's default security levels. It is important to note that certain versions of SaferWeb may be associated with a setup file signed by WEB PICK - INTERNET HOLDINGS LTD, which serves as the partner installer/distributor.