Savevalet

jowsleyyy · May 29, 2013

I've tried everything that I know to try to delete this off the system. The basic 'google' search came up with results, but none could completely get rid of the Savevalet. I'm at my wits end =( The bug is driving me crazy, every time I google, youtube, ebay, almost anything, it shows up there.

I am able to follow directions, I've removed a FBI moneypak virus from my bosses computer at work once through Safe mode and deleting everything from the in all the hkey local machine folders (took a while, but it was fixed) So I know my way around a computer, I just don't know where to look without being told where =\

Please help me get rid of this bug! TIA!

Also I used this link to try to get rid of the bug. I did everything on this page.

Littlebits · May 29, 2013

Go to this page- https://www.savevalet.com/uninstall.html and download the uninstaller for your browsers.

There is three separate uninstallers for each browser. Make sure to close your browsers before running the uninstallers, that should take care of the problem.

If not read our full removal guide here- http://malwaretips.com/blogs/remove-save-valet-uninstall-guide/

Enjoy!!

kuttus · May 29, 2013

Hi and welcome to the malwaretips.com forums!

I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:

I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine!
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Refrain from running self fixes as this will hinder the malware removal process.
It may prove beneficial if you print of the following instructions or save them to notepad as I post them.

Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
<hr />

STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL

Code:

:OTL [2012/11/04 20:40:49 | 002,042,908 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\firebug@software.joehewitt.com.xpi [2012/06/21 18:30:45 | 000,319,802 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\firefox@facebook.com.xpi [2013/04/10 21:52:01 | 000,226,606 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\gmailwatcher@sonthakit.xpi [2013/04/10 21:53:42 | 000,021,606 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\leethax@leethax.net.xpi [2013/04/10 21:52:01 | 000,111,726 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\{89f8dde0-010a-11da-8cd6-0800200c9a66}.xpi [2013/05/15 10:28:25 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012/05/11 17:15:52 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2013/04/19 00:55:24 | 000,002,548 | ---- | M] () -- C:\Users\Jason\AppData\Roaming\Mozilla\Firefox\Profiles\qlbj28g6.default\searchplugins\aol-search.xml [2012/05/11 16:35:43 | 000,003,584 | ---- | C] () -- C:\Users\Jason\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini :commands [emptytemp] [reboot]

<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>

<hr />

jowsleyyy · May 29, 2013

Littlebits I tried what you suggested, and the full removal guide is what brought me here. I've tried that already, as posted in my thread. Thanks though!

Kuttus I ran the test, on reboot I came up with a notepad document, and then I ran another OTL scan. The file on reboot is the 05292013 file name. OTL2 is the second time I ran the OTL sign.

kuttus · May 29, 2013

Download Malwarebytes Anti-Rootkit from here to your Desktop

Unzip the contents to a folder on your Desktop.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Make sure there is a check next to Create Restore Point and click the Cleanup button to remove any threats. Reboot if prompted to do so.
After the reboot, perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If there are threats, click Cleanup once more and reboot.
When done, please post the two logs in the MBAR folder(mbar-log.txt and system-log.txt)

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
When it prompts you to try their 30-day trail, click decline
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

STEP 2: Run a scan with AdwCleaner

<ol><li>Download AdwCleaner from the below link.
<><a href="http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner" target="_blank">ADWCLEANER DOWNLAOD LINK</a></> (This link will automatically download Security Check on your computer)</li>

<li>Close all open programs and internet browsers.</li>
<li>Double click on <>adwcleaner.exe</> to run the tool.</li>
<li>Click on <>Delete</>,then confirm each time with <>Ok</>.</li>
<li>Your computer will be rebooted automatically. A text file will open after the restart.</li>
<li>Please post the contents of that logfile with your next reply.</li>
<li>You can find the logfile at <>C:\AdwCleaner[S1].txt</> as well.</li>
</ol>
<hr/>
STEP 3: Run a scan with Junkware Removal Tool

Please download Junkware Removal Tool to your desktop from here

Turn off your antivirus software now to avoid potential conflicts

Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator

The tool will open and start scanning your system

Please be patient as this can take a while to complete depending on your system's specifications

On completion, a log (JRT.txt) will be saved to your desktop and will automatically open

Post the contents of JRT.txt into your next reply

jowsleyyy · May 29, 2013

Hello,

I followed your directions, here are the results:
1. Found 2 malware and removed it. I added the text files as mbar and system log.
2. The program didn't find anything. I added the file as mbam.
3. I ran the adwcleaner. The file is named adwcleaner.
4. I ran the jrt. The file name is JRT.

I googled something, the savevalet is still here.

kuttus · May 29, 2013

STEP 1: Run a scan with ESET Online Scanner
<ol>
<li>Download ESET Online Scanner utility from the below link
<><a title="External link" href="http://download.eset.com/special/eos/esetsmartinstaller_enu.exe" rel="nofollow">ESET ONLINE SCANNER DOWNLOAD LINK</a></> (This link will automatically download ESET Online Scanner on your computer.)</li>
<li>Double click on the Eset installer program (esetsmartinstaller_enu.exe).</li>
<li>Check <>Yes, I accept the Terms of Use</></li>
<li>Click the <>Start</> button.</li>
<li>Check <>Scan archives</></li>
<li>Push the <>Start</> button.</li>
<li>ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.</li>
<li>When the scan completes, push <>List of found threats</></li>
<li>Push <>Export to Text file </> and save the file to your desktop using a unique name, such as <>ESET Scan</>. Include the contents of this report in your next reply.Note - when ESET doesn't find any threats, no report will be created.</li>
<li>Push the <>back</> button.</li>
<li>Push <>Finish</></li>
</ol>
<hr />
STEP 2: Run a scan with Kaspersky Virus Removal Tool
<ol><li>Download Kaspersky Virus Removal Tool from the below link and then double click on it to start this utility.
<><a title="External link" href="http://www.kaspersky.com/antivirus-removal-tool?form=1" rel="nofollow">KASPERSKY VIRUS REMOVAL TOOL</a></> (This link open an new webpage from where you can download Kaspersky Virus Removal Tool on your computer.)</li>
<li>Follow the onscreen prompts until it is installed</li>
<li>Click the Options button (the 'Gear' icon), then make sure only the following are ticked:
<ul>
<li>System Memory</li>
<li>Hidden startup objects</li>
<li>Disk boot sectors</li>
<li>Local Disk (C: )</li>
<li>Also any other drives (Removable that you may have)</li>
</ul>
</li>
<li>Then click on <>Actions</> on the left hand side</li>
<li>Click <>Select Action</>, then make sure both <>Disinfect</> and <>Delete if disinfection fails</> are ticked</li>
<li>Click on <>Automatic Scan</></li>
<li>Now click the <>Start Scanning</> button, to run the scan</li>
<li>After the scan is complete, click the reports button ('Paper icon', next to the 'Gear' icon) on the right hand side</li>
<li>Click <>Detected threats</> on the left</li>
<li>Now click the <>Save</> button, and save it as <>kaslog.txt</> to your <>Desktop</></li>
<li>Please attach kaslog.txt in your next reply.</li>
</ol>
<hr />

jowsleyyy · May 29, 2013

Hello,

I attached the ESET scan below. The program found 2 bugs. The second scan did not come up with any results.

The savevalet is still in my google search.

kuttus · May 29, 2013

In which browser you see the savevalet now? Could you please send me a Screenshot of the same?

To Take Screen Of Your Screen.

Press PRINT SCREEN (Print Scr) key on Your Keyboard.
Now Open MS Paint
Open Paint by clicking the Start button

, clicking All Programs, clicking Accessories, and then clicking Paint.
In MS Paint Click Edit, and then click Paste.
After this Save the File on your computer by Clicking on File --> Save

Add this Saved File in your next Replay

jowsleyyy · May 29, 2013

I attached what I see in youtube and google. This also happens in ebay. I have adblock plus, and it was blocking all ads before this happened. Once savevalet started to show up in youtube and ebay, all the ads on the pages started showing up like crazy.

kuttus · May 29, 2013

Please go to the following location in Google Chrome and delete all Adons there.....

chrome://extensions/

Copy and Paste the following location into the address bar of Google Chrome and hit on Enter......

jowsleyyy · May 30, 2013

I honestly feel like an idiot...

Do you think it latched onto one of my add-ons? Would it be safe to re-add any of the previous add-ons?

I had installed facebook toolbar, adblock plus, google mail checker, yahoo mail checker, houston texans theme, and photo zoom for facebook.

Also, THANK YOU SO MUCH. My blood pressure will be much lower now haha. Is there any addons or firewall that you would recommend? I have McAfee installed, and I run some scans from time to time with CC cleaner.

Littlebits · May 30, 2013

jowsleyyy said:
I honestly feel like an idiot...

Do you think it latched onto one of my add-ons? Would it be safe to re-add any of the previous add-ons?

I had installed facebook toolbar, adblock plus, google mail checker, yahoo mail checker, houston texans theme, and photo zoom for facebook.

Also, THANK YOU SO MUCH. My blood pressure will be much lower now haha. Is there any addons or firewall that you would recommend? I have McAfee installed, and I run some scans from time to time with CC cleaner.

Save Valet is a browser extension developed by Save Valet LLC and is compatible with Internet Explorer, Google Chrome and Mozilla FireFox. Creators of this browser add-on claims that it will help save money and time while shopping online. This extension displays price comparison ads when users visits amazon.com, eBay.com and other popular online shopping websites. While some computer users may find such price comparison ads useful, many Internet users have reported that Save Valet was installed on their Internet browsers without their consent.

http://www.pcrisk.com/removal-guides/7046-remove-save-valet-adware

It is just a simple adware browser extension, it is not malicious, more of a nag since it displays ads.

I have removed it from my customers systems many times by just using the uninstallers from their website. In every case, the uninstallers removed all traces of it without having to do anything else.

Unlike most adware, SaveValet offers free email support removing their products. They run a clean business. https://www.savevalet.com/contact.html

SaveValet is bundled in installers for free products, it is always optional by running custom installations. Taking time to read the installation process might help you from getting bundled adware installed. Sometimes you might have to uncheck items because they will be selected by default.

You can use their service https://www.savevalet.com/ which is pretty good at finding good prices without installing their extensions.

I hope that helps you.

kuttus · May 30, 2013

Are you facing any other issues on the computer now?

Now that your PC is clean, I recommend you to create a new System Restore point then purge the old ones after.

For XP
How to create a Restore Point in XP
Delete all restore points except the most recent one

For Vista
Create a restore point
Delete all but the most recent restore point

For Windows 7
Create a restore point
Delete all but the most recent restore point - Click the Delete all but the most recent restore point link

Keep your system updated

Keeping your programs (especially Adobe and Java products) updated is essential. Update Checker will notify you if any of your programs require an update.
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office product bugs and vulnerabilities.
Please ensure you update your system regularly and have automatic updates on. You can learn how to turn Automatic Updates on here

I also recommend you to switch your antivirus program to a better one. Here are some suggestions:

avast! 7 Home Edition - Don't use it with Online Armor
Avira AntiVir Personal
Microsoft Security Essentials

In addition to your antivirus, you need additional protection such as a firewall and behavioural blocker.

Online Armor
Comodo Firewall - If you are an advance user

Here are only a few suggestions that will improve your system security. Should you wish to allow us to make full recommendations and set your PC up with maximum security, please start a thread here. Our community of PC enthusiasts and experts will give you feedback and help you secure your system from future malware infections.

Internet Explorer may be the most popular browser but it's definitely not the most secure browser. Consider using other browsers with addition add-ons to safeguard your system while browsing the internet.

Firefox is a more secure, faster browser than Internet Explorer. Firefox contains less vulnerabilities, reducing the risk of drive-by downloads. In addition, you can add the following add-ons to increase security.

KeyScramber - Encrypts your keystrokes to protect you against keyloggers that steals personal & banking information
AdBlock - Disable/blocks advertisements on websites so you won't accidentally click on a malicious ad.
NoScript - Disables Flash & Java contents to avoid exploits or drive-by attacks
Web of Trust - Shows the website rating by other users and blocks dangerous and poor-rated sites

Google Chrome is another good browser that is faster and more secure than Internet Explorer by having a sandbox feature. Additionally, you can add the following add-on to Chrome to heighten security.

AdBlock

Lastly, it is important to perform system maintenance on a regular basis. Here are a few tools and on-demand scanners that you should keep & use every 1-2 weeks to keep your system healthy.

Other than that, stay safe out there! If you have any other questions or concerns, feel free to ask

<hr />
What's next?

Bulild up your malware defenses by starting a new thread in Security Configuration Wizard forum.
Learn how to avoid malware by reading this article <a href="http://malwaretips.com/blogs/how-to-easily-avoid-pc-infections/">How to easily avoid malware</a>
Be an active member in the MalwareTips community!

My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.

jowsleyyy · May 30, 2013

Thank you so much! I'll post in the build up defense thread whenever I get the chance to play around with my parents computer. My mom likes to click on random ads -.-

ps: THANK YOUUU

kuttus · May 30, 2013

This thread is now closed.

Reason: Issue Resolved

<>The procedures contained in this thread are for this user and this user only.  Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair.  </>

<>DO NOT use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.</>

All members requesting Malware Removal Assistance are required to follow all procedures in the thread

My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.

Search

Savevalet

jowsleyyy

New Member

Littlebits

Retired Staff

kuttus

Level 2

jowsleyyy

New Member

kuttus

Level 2

jowsleyyy

New Member

kuttus

Level 2

jowsleyyy

New Member

kuttus

Level 2

jowsleyyy

New Member

Attachments

kuttus

Level 2

jowsleyyy

New Member

Littlebits

Retired Staff

kuttus

Level 2

jowsleyyy

New Member

kuttus

Level 2

Similar threads