Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with savenshare


  • Please log in to reply
6 replies to this topic

#1 Bahawolf

Bahawolf

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 10 September 2013 - 08:15 PM

Hello!

I was downloading a font that came with an installer and mistakenly clicked 'Next' without un-checking the box to install the bloatware tied with it. Stupid decision, I know. I've already gone ahead and removed the application and tried to run Malwarebytes, Adwcleaner, Combobox, and SuperAntispyware FREE in Safe Mode. Unfortunately, I still receive popups from this while browsing (regardless of the browser) and it injects popovers into links for paid services / projects.

 

I'm running Windows 8 and would typically format but I'm so swamped with work that I can't right now. Any help would be greatly appreciated!



BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:43 AM

Posted 10 September 2013 - 09:01 PM

Hello -

This should be a simple Add-on to remove.

 

You can uninstall SaveNShare from your computer by using the Add/Remove Program feature in the Window's Control Panel.

1.On the Start menu (for Windows 8, right-click the screen's bottom-left corner), click Control Panel, and then, under Programs, do the following:
Windows Vista/7/8: Click Uninstall a Program.

2.When you find the program SaveNShare, click it, and then do the following:
Windows Vista/7/8: Click Uninstall.

3.Follow the prompts. A progress bar shows you how long it will take to remove SaveNShare.

 

NEXT -

Please download Junkware Removal Tool by thisisu to your desktop
Shut down your protection software now to avoid potential conflicts.

See How To Temporarily Disable Your Anti-virus while this program runs
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Re-Enable your Antivirus Now -

 

Thank You -

EDIT - These programs are not designed for Safe Mode - Malwarebytes, Adwcleaner, and SuperAntispyware FREE.


Edited by noknojon, 10 September 2013 - 09:04 PM.


#3 Bahawolf

Bahawolf
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 10 September 2013 - 09:21 PM

Hello!

Thank you for the prompt response! I went ahead and disabled Norton and ran JRT as instructed. I have since re-enabled Norton as instructed. - I did remove savenshare via Add/Remove Programs when it first appeared but it no longer appears there.

 

Below is my JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.9 (09.07.2013:1)
OS: Windows 8 x64
Ran by Anastacia on Tue 09/10/2013 at 22:12:42.48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\ProgramData\big fish games"
Successfully deleted: [Folder] "C:\windows\syswow64\ai_recyclebin"
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 09/10/2013 at 22:18:12.52
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Thank you!



#4 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:43 AM

Posted 11 September 2013 - 12:09 AM

> > Successfully deleted: [Folder] "C:\ProgramData\big fish games"  <<

This was most likely the only remains of the program left.

 

The Add-on usually removes fairly simply -

 

Do you still have any other problems ??

 

Thank You -



#5 Bahawolf

Bahawolf
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 11 September 2013 - 12:59 AM

Hey there!

It was still around but I went ahead and checked my browser extensions again and found it in there twice! :-) I removed it and we're good to go!



#6 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:43 AM

Posted 11 September 2013 - 01:08 AM

I will watch this topic to see if it still annoys you, and we can use other tools .

 

Thank You -



#7 Bahawolf

Bahawolf
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 11 September 2013 - 01:16 AM

Thank you so much! - I really appreciate it.

 

I restarted and it appears to be gone but I'll be the first to tell you if it comes back. :-)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users