Special Savings Removal: Remove Special Savings Forever

Threat indicator: HIGH

Threat's profile

Name of the threat:

Command or file name:

Threat type:

Affected OS:

Special Savings



Win32 (Windows XP, Vista, Seven, 8)

Special Savings

Special Savings intrusion method

Special Savings copies its file(s) to your hard disk. Its typical file name is DealFinderSetup.exe. Then it creates new startup key with name Special Savings and value DealFinderSetup.exe. You can also find it in your processes list with name DealFinderSetup.exe or Special Savings.

If you have further questions about Special Savings, please fill in the form below and we'll contact you shortly.

Recommended Solution - Download SpyHunter by Enigma Software Group LLC

Download this advanced tool and solve problems with Special Savings and DealFinderSetup.exe (download of fix will start immediately):

Download Spyhunter to remove Special Savings and DealFinderSetup.exe now!

* SpyHunter was developed by US-based company EnigmaSoftware and is able to remove Special Savings-related issues in automatic mode. Program was tested on Windows XP, Windows Vista, Windows 7 and Windows 8.

Share if this helped!


* Removes all files created by Special Savings.

* Removes all registry entries created by Special Savings.

* You can activate System and Network Guards and forget about malware.

* Can fix browser problems and protect browser settings.

* Removal is guaranteed - if SpyHunter fails ask for FREE support.

* 24/7 Spyware Helpdesk Support included into the package.

Alternative Solution - Download Special Savings Removal Tool by Security Stronghold LLC

Download this simplified Removal Tool designed specifically to solve problems with Special Savings and DealFinderSetup.exe (download of fix will start immediately):

Download removal tool for Special Savings and DealFinderSetup.exe now!


* Removes all files created by Special Savings.

* Removes all registry entries created by Special Savings.

* Fixes browser redirection and hijack if needed.

* Can immunize your drives from specific problem.

* Removal is guaranteed - if Removal Tool fails ask for FREE support.

* 24/7 Helpdesk Support and 5 hours of Remote Support via GoToAssist included into the package.

Let our support team solve your problem with Special Savings and repair Special Savings right now!

Leave the detailed description of your Special Savings problem in the form below. Our support team will contact you in several minutes and give a step-by-step instruction on how to fix Special Savings problem. Please be specific. Do your best describing the problem. This will help us recommend right and complete Special Savings problem removal solution.

Click to ask professional of Special Savings solution

Describe your problem here and we'll contact you in several minutes:

We'll reply you in 10 minutes or less
* Name:
* E-mail:
* Problem summary:
* Detailed description:
Attach suspicious file:
Here you can attach file you suspect to be virus or source of problem. If you want to attach several files, put them into one archive and attach it instead.

We'll contact you back in 10 minutes or less after you click on this button.

Individual solution guaranteed!


It is important:

  1. We hate spam as much as you do. We will not share your email with any third party or publish it anywhere. Your email is used only to contact you and give you Special Savings removal solution.
  2. All fields of this form are obligatory.

Software Industry Professionals Member
Threat's description and solution are developed by Security Stronghold security team.

Here you can also learn:

* What is Special Savings? Technical details of Special Savings problem and Special Savings removal tool.

* Methods for manual Special Savings removal.

* Instant download of a program that will solve your problem automatically.

How to remove Special Savings manually?

This problem can be solved manually by deleting all registry keys and files connected with Special Savings, removing it from starup list and unregistering all corresponding DLLs. Additionally missing DLL's should be restored from distribution in case they are corrupted by Special Savings.

To get rid of Special Savings, you should:

1. Kill the following processes and delete the appropriate files:

• ibsvc.exe
• AddonsFramework.dll
• ButtonSite.dll
• ontent.js
• PropertySync.exe
• PropertySyncPS.dll
• ScriptHost.dll
• uninstall.exe
• updater.js
• updaterWrapper.js

Warning: you should delete only those files which checksums are listed as malicious. There may be valid files with the same names in your system. We recommend you to use Special Savings Removal Tool for safe problem solution.

2. Delete the following malicious folders:

• C:\Documents and Settings\{Username}\Application Data\Mozilla\Extensions\SpecialSavings@SpecialSavings.com
• C:\Documents and Settings\{Username}\Application Data\SpecialSavings
• C:\Documents and Settings\{Username}\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bfcpnihmbfoaeoakalclfalkdepgiaje
• C:\Documents and Settings\All Users\Application Data\IBUpdaterService
• C:\Program Files\SpecialSavings

3. Delete the following malicious registry entries and\or values:

  • Key: HKLM\SOFTWARE\Classes\AppID\AddonsFramework.DLL
  • Key: HKLM\SOFTWARE\Classes\AppID\ButtonSite.DLL
  • Key: HKLM\SOFTWARE\Classes\AppID\PropertySync.EXE
  • Key: HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
  • Key: HKLM\SOFTWARE\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}
  • Key: HKLM\SOFTWARE\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}
  • Key: HKLM\SOFTWARE\Classes\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}
  • Key: HKLM\SOFTWARE\Classes\CLSID\{4EC06F7F-2290-4D9E-8D24-54CE42766B04}
  • Key: HKLM\SOFTWARE\Classes\CLSID\{938958E8-355C-49FF-92B0-53C1B87ACEA9}
  • Key: HKLM\SOFTWARE\Classes\CLSID\{AFFE513B-69AD-4C97-A74F-95AB17C9D42C}
  • Key: HKLM\SOFTWARE\Classes\CLSID\{C718BDD4-197A-4A23-B539-EB3B3A2B0C09}
  • Key: HKLM\SOFTWARE\Classes\AddonsFramework.Navbar
  • Key: HKLM\SOFTWARE\Classes\AddonsFramework.PropertySyncObj
  • Key: HKLM\SOFTWARE\Classes\ScriptHost.Tool
  • Key: HKLM\SOFTWARE\Classes\SpecialSavings.ScriptHostObject
  • Key: HKLM\SOFTWARE\Google\Chrome\Extensions\bfcpnihmbfoaeoakalclfalkdepgiaje
  • Key: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4C6BD4F1-CD51-451e-9000-6A82A14AAC22}
  • Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{938958E8-355C-49FF-92B0-53C1B87ACEA9}
  • Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpecialSavings
  • Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
  • Key: HKLM\SYSTEM\ControlSet001\Services\IBUpdaterService

Warning: if value is listed for some registry entries, you should only clear these values and leave keys with such values untouched. We recommend you to use Special Savings Removal Tool for safe problem solution.

4. Manually fix browser problems

Special Savings can affect your browsers which results in browser redirection or search hijack. We recommend you to use free option "Reset Browsers" under "Tools" in Special Savings Removal Tool to reset all the browsers at once. Mention that you need to remove all files and kill all processes belonging to Special Savings before doing this. To reset your browsers manually and restore your homepage perform the following steps:

Internet Explorer

  • If you use Windows XP, click Start, and then click Run. Type the following in the Open box without quotes, and press Enter: "inetcpl.cpl"

  • If you use Windows 7 or Windows Vista, click Start. Type the following in the Search box without quotes, and press Enter: "inetcpl.cpl"

  • Click the Advanced tab

  • In Reset Internet Explorer settings, click Reset. Click Reset in opened window again.

  • Select Delete personal settings checkbox to remove browsing history, search providers, homepage

  • After Internet Explorer finishes resetting, click Close in the Reset Internet Explorer Settings dialog box

Warning: In case this option will not work use free option Reset Browsers under Tools in Special Savings Removal Tool.

Google Chrome

  • Go to the installation folder of Google Chrome: C:\Users\"your username"\AppData\Local\Google\Chrome\Application\User Data.

  • In the User Data folder, look for a file named as Default and rename it to DefaultBackup.

  • Launch Google Chrome and a new clean Default file will be created.

Warning: This option might not work if in Google Chrome you use online synchronization between PCs. In this case use free option Reset Browsers under Tools in Special Savings Removal Tool.

Mozilla Firefox

  • Open Firefox

  • Go to Help > Troubleshooting Information in menu.

  • Click the Reset Firefox button.

  • After Firefox is done, it will show a window and crreate folder on the desktop. Click Finish.

Warning: This option will also clean all your account passwords for all websites. If you don't want it use free option Reset Browsers under Tools in Special Savings Removal Tool.

Information provided by: Alexey Abalmasov

Next threat: Jollywallet »

Learn more about Special Savings and DealFinderSetup.exe »

« Back to catalog

Home | Partners | Shop | Support | Terms of use | Contact Us | Privacy Policy | Sitemap

Copyright © 2014 Security Stronghold. All Rights Reserved.