Safe Saver

Safe Saver

Known Adware

by Moshe Caspi

What is Safe Saver?

Safe Saver is software application developed by Moshe Caspi. It is most commonly found on computers running Windows 7 with nearly 62.44% of installations running this operating system. Safe Saver's installer is typically 7.00 MB in size and installs around 15 files. The most common release is 1.27.153.8 with 79.35% of all installations currently using this version.

Safe Saver is most popular in the United States with 98.31% of installations residing in this country.

Safe Saver adds 1 scheduled task to the Windows Task Scheduler launching the program at randomly scheduled times.

About Safe Saver?

Safe Saver (Safe Save) developed by Moshe Caspi of bestdealapp.info is a potentially unwanted software that can act as adware or spyware. This web browser extension is known for modifying the default or custom settings of the browser, including the home page and search settings. It also affects the functionality of the browser, such as new tabs. Furthermore, Safe Saver can manipulate the security settings of the PC and Windows Internet Explorer by setting approved security zones for specific domains. It may attempt to download and install files from these domains into the OS in temporary directories, such as the Internet Explorer Cache. Once installed, the software adds various execution points, including a CopyHookHandler, Approved Shell Extension, Browser Helper Object, and Plugins for Chrome and Firefox.

Multiple virus scanners have detected malware in Safe Saver.

utils.exe (MD5: 98765eda7372fcbe329b702a3a80ab09) has been flagged by 17 scanners:
Scanner Software Result
Antiy-AVL AdWare/Win32.Lyckriks
Baidu-International Trojan.Win32.Agent.AwLZ
Bkav FE W32.Clodf83.Trojan
Dr.Web Adware.Plugin.73
ESET-NOD32 Win32/Packed.ScrambleWrapper.C
Fortinet FortiGate Adware/Lyckriks
Jiangmin AdWare/Lyckriks.bf
Kaspersky not-a-virus:AdWare.Win32.Lyckriks
TrendMicro-HouseCall TROJ_GEN.R0CBH07JG13
Vba32 AntiVirus AdWare.Lyckriks
K7 AntiVirus Riskware
K7GW Riskware
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
McAfee Artemis!F75B89C57D58
McAfee-GW-Edition Artemis!F75B89C57D58
VIPRE Antivirus Crossrider (fs)
AVG Generic_r.GS
Safe Saver-updater.exe (MD5: 90ad4750e6c43eb3d0a5e4a78492922b) has been flagged by 6 scanners:
Scanner Software Result
AVG Generic_r.GS
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
TrendMicro-HouseCall TROJ_GEN.F47V0925
VIPRE Antivirus Crossrider (fs)
Dr.Web Trojan.Crossrider.1
Safe Saver-enabler.exe (MD5: 780958166d993a0e5a2afa77ac7a13f3) has been flagged by 8 scanners:
Scanner Software Result
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.J
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
McAfee Artemis!780958166D99
McAfee-GW-Edition Artemis!780958166D99
TrendMicro-HouseCall TROJ_GEN.F47V1015
VIPRE Antivirus Crossrider (fs)
AVG Generic_r.GS
Dr.Web Trojan.Crossrider.1
Safe Saver-codedownloader.exe (MD5: 082f2fb8f2e1247ddc2c7c7888cdafe2) has been flagged by 4 scanners:
Scanner Software Result
Dr.Web Trojan.Crossrider.1
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.I
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
VIPRE Antivirus Crossrider (fs)
Safe Saver-bho.dll (MD5: f75b89c57d58fbfb6c6b500292d30005) has been flagged by 10 scanners:
Scanner Software Result
Dr.Web Trojan.Crossrider.1
ESET-NOD32 a variant of Win32/Toolbar.CrossRider.H
K7 AntiVirus Riskware
K7GW Riskware
Kingsoft AntiVirus Win32.Troj.Generic.a.(kcloud)
McAfee Artemis!F75B89C57D58
McAfee-GW-Edition Artemis!F75B89C57D58
VIPRE Antivirus Crossrider (fs)
TrendMicro-HouseCall TROJ_GEN.F47V1015
AVG Generic_r.GS

Software Behaviors

Scheduled tasks:
  • Safe Saver-enabler.exe is scheduled as a task named 'temp_Safe Saver-enabler'.

Startup Entries

Startup tasks:
  • Safe Saver-enabler.exe is automatically launched at startup through a scheduled task named Safe Saver-enabler.
  • Safe Saver-firefoxinstaller.exe is automatically launched at startup through a scheduled task named Safe Saver-firefoxinstaller.
  • Safe Saver-chromeinstaller.exe is automatically launched at startup through a scheduled task named Safe Saver-chromeinstaller.
  • Safe Saver-updater.exe is automatically launched at startup through a scheduled task named Safe Saver-updater.
  • Safe Saver-codedownloader.exe is automatically launched at startup through a scheduled task named Safe Saver-codedownloader.

Software Details

URL:
https://safesaver.net
Support:
Installation path:
C:\Program Files\safe saver
Uninstaller:
C:\Program Files\Safe Saver\Uninstall.exe
Size:
7.00 MB
Language:
English

Safe Saver Executable Details

Primary executable:
utils.exe
Name:
Safe Saver
Path:
C:\Program Files\safe saver\utils.exe
MD5:
98765eda7372fcbe329b702a3a80ab09
SHA-1:
SHA-256:
Files installed by Safe Saver
File Type Filename MD5
EXE
93d3c83fa401601c916e531275680c0a
EXE
utils.exe
Malware
98765eda7372fcbe329b702a3a80ab09
EXE
90ad4750e6c43eb3d0a5e4a78492922b
EXE
40230cb251b6f66a9fb1490ae4d07861
EXE
780958166d993a0e5a2afa77ac7a13f3
EXE
082f2fb8f2e1247ddc2c7c7888cdafe2
EXE
b1f17c9420fae9d5c5474d17500a0b6d
EXE
c8f1892feba6b1e846180bbd9e2270b2
EXE
1af9fe07f116892e17557836425fd154
DLL
f75b89c57d58fbfb6c6b500292d30005