Removal instructions for Supra Savings

[Metallica]

What is Supra Savings?

The Malwarebytes research team has determined that Supra Savings is adware. Adware typically shows you advertisements that do not belong on the site you are visiting.

How do I know if my computer is affected by Supra Savings?

You may find this listing in you list of installed programs:

How did Supra Savings get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Supra Savings?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application.

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  • Enable free trial of Malwarebytes Anti-Malware Premium
  • Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now.
• When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
• Reboot your computer if prompted.

Is there anything else I need to do to get rid of Supra Savings?

• No, Malwarebytes' Anti-Malware removes Supra Savings completely.

How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this hijacker.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Supra Savings rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Signs in a HijackThis log:

O23 - Service: buuoujqmrk32 - Unknown owner - C:\Program Files\003\buuoujqmrk32.exe

Note: the name of the service and the file seem to be random.

Alterations made by the installer:

File system details  ---------------------------------------------    Adds the folder C:\Program Files\003       Adds the file buuoujqmrk32.exe"="3/29/2014 9:46 AM, 541696 bytes, A    Adds the folder C:\Program Files\suprasavings       Adds the file uninstaller.exe"="3/27/2014 2:26 PM, 80058 bytes, ARegistry details  ----------------------------------------------    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\suprasavings]       "DisplayIcon"="REG_SZ", "C:\Program Files\suprasavings\uninstaller.exe"       "DisplayName"="REG_SZ", "suprasavings"       "DisplayVersion"="REG_SZ", "2.0.1"       "EstimatedSize"="REG_DWORD", 1024       "Publisher"="REG_SZ", "suprasavings"       "UninstallString"="REG_SZ", "C:\Program Files\suprasavings\uninstaller.exe -source="F978377C-B7D4-4536-8E10-14CA97B13394" -remove="739027FD-0200-4F32-A9AC-8E4058065C1A D12C40DB-CD7D-4D86-9285-5E2FE23693E4 E6B105B8-1F65-4428-9397-1DFD8A03B94D 3566FB70-E722-4182-8266-815EAE862998 9B65F9A3-9D24-452A-B6EF-1457D65E4259 6DDE8071-E4BA-461B-8A96-990DFAA0EBD1 9B5C9A87-ED19-4510-A63F-A23FB580CA75 BFB5F375-2733-465B-B3AC-842F6A6BE527 DB8B6107-7401-470E-9203-F83DF395F044 813BA625-B0FA-48D8-9B75-59759C88C219 6E810AB6-F34E-49A3-A93F-9E503660F718 286B09BC-F9BD-4F71-B767-2AE0CE2F8CE5" "       "URLInfoAbout"="REG_SZ", "${application_url}"    [HKEY_LOCAL_MACHINE\SOFTWARE\suprasavings]       "key"="REG_SZ", "F978377C-B7D4-4536-8E10-14CA97B13394"    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\buuoujqmrk32]       "DisplayName"="REG_SZ", "buuoujqmrk32"       "ErrorControl"="REG_DWORD", 1       "FailureActions"="REG_BINARY, .....................6       "ImagePath"="REG_EXPAND_SZ, "C:\Program Files\003\buuoujqmrk32.exe run options=01110010030000000000000000000000 sourceguid=F978377C-B7D4-4536-8E10-14CA97B13394"       "ObjectName"="REG_SZ", "LocalSystem"       "Start"="REG_DWORD", 2       "Type"="REG_DWORD", 16    [HKEY_CURRENT_USER\Software\AppDataLow\Software\suprasavings]       "key"="REG_SZ", "F978377C-B7D4-4536-8E10-14CA97B13394"

Malwarebytes Anti-Malware log:

Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 3/29/2014Scan Time: 10:09:28 AMLogfile: mbamSupra.txtAdministrator: YesVersion: 2.00.0.1000Malware Database: v2014.03.29.01Rootkit Database: v2014.03.27.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledChameleon: DisabledOS: Windows 7 Service Pack 1CPU: x86File System: NTFSUser: MalwarebytesScan Type: Threat ScanResult: CompletedObjects Scanned: 205114Time Elapsed: 18 min, 9 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledShuriken: EnabledPUP: EnabledPUM: EnabledProcesses: 1Trojan.Agent.SVR, C:\Program Files\003\buuoujqmrk32.exe, 6828, Delete-on-Reboot, [17ee14f58dee082e27db4f1533ceb24e]Modules: 0(No malicious items detected)Registry Keys: 3Trojan.Agent.SVR, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\buuoujqmrk32, Quarantined, [17ee14f58dee082e27db4f1533ceb24e], PUP.Optional.SupraSavings.A, HKLM\SOFTWARE\suprasavings, Quarantined, [d92c1cedb7c4a294203f104780820ef2], PUP.Optional.SupraSavings.A, HKU\S-1-5-21-4016700205-1717049133-1125222536-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\suprasavings, Quarantined, [15f0d33694e78ea82839a3b4649e7789], Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 1PUP.Optional.SupraSavings.A, C:\Program Files\suprasavings, Quarantined, [f90c8782b0cbdf57b6593f18d230639d], Files: 3Trojan.Agent.SVR, C:\Program Files\003\buuoujqmrk32.exe, Delete-on-Reboot, [17ee14f58dee082e27db4f1533ceb24e], PUP.Optional.SupraSavings.A, C:\Users\{username}\Desktop\Supra Savings ( AdPeak variant).exe, Quarantined, [6c99a267ff7cb77fd93947bf847ea957], PUP.Optional.SupraSavings.A, C:\Program Files\suprasavings\uninstaller.exe, Quarantined, [f90c8782b0cbdf57b6593f18d230639d], Physical Sectors: 0(No malicious items detected)(end)

As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.

We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.