Follow:

 

Adware:Win32/Adpeak


Microsoft security software detects and removes this unwanted software.

This adware program shows ads as you browse the web, without telling you where the ads are coming from.

It can be downloaded from the program's website or bundled with some third-party software installation programs.

Find out more about how and why we identify unwanted software.



What to do now

This program poses a high threat to your PC.

Remove programs

You might need to manually remove this program:

The entry for this program may be called "ScorpionSaver".

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other unwanted software from your PC:

You should also run a full scan. A full scan might find other, hidden threats.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Installation

Adware:Win32/Adpeak can be downloaded from the program's website or bundled with some third-party software installation programs.

It creates the following files in %ProgramFiles%\ScorpionSaver:

  • background.js
  • bootstrap.js
  • bootstrap.js.old
  • CustomActionInstall
  • CustomActionUninstall
  • ff_addonkit_page-mod.js
  • ff_addonkit_private-browsing.js
  • ff_addonkit_request.js
  • ff_addonkit_windows.js
  • ff_addon_runner.js
  • ff_base_api-utils.js
  • ff_base_base64.js
  • ff_base_byte-streams.js
  • ff_base_collection.js
  • ff_base_content.js
  • ff_base_cortex.js
  • ff_base_cuddlefish.js
  • ff_base_deprecate.js
  • ff_base_environment.js
  • ff_base_errors.js
  • ff_base_events.js
  • ff_base_file.js
  • ff_base_functional.js
  • ff_base_globals.js
  • ff_base_heritage.js
  • ff_base_hidden-frame.js
  • ff_base_light-traits.js
  • ff_base_list.js
  • ff_base_loader.js
  • ff_base_match-pattern.js
  • ff_base_memory.js
  • ff_base_namespace.js
  • ff_base_observer-service.js
  • ff_base_plain-text-console.js
  • ff_base_preferences-service.js
  • ff_base_promise.js
  • ff_base_querystring.js
  • ff_base_runtime.js
  • ff_base_sandbox.js
  • ff_base_self.js
  • ff_base_system.js
  • ff_base_text-streams.js
  • ff_base_timer.js
  • ff_base_traceback.js
  • ff_base_traits.js
  • ff_base_unload.js
  • ff_base_url.js
  • ff_base_uuid.js
  • ff_base_window-utils.js
  • ff_base_xhr.js
  • ff_base_xpcom.js
  • ff_base_xul-app.js
  • ff_bootstrap.js
  • ff_content_content-proxy.js
  • ff_content_content-worker.js
  • ff_content_loader.js
  • ff_content_symbiont.js
  • ff_content_worker.js
  • ff_dom_events.js
  • ff_events_assembler.js
  • ff_event_core.js
  • ff_event_target.js
  • ff_harness-options.json
  • ff_icon.png
  • ff_icon64.png
  • ff_install.rdf
  • ff_l10n_core.js
  • ff_l10n_html.js
  • ff_l10n_loader.js
  • ff_l10n_locale.js
  • ff_l10n_prefs.js
  • ff_locales.json
  • ff_main.js
  • ff_main.js.old
  • ff_prefs.js
  • ff_privatebrowsing_utils.js
  • ff_system_events.js
  • ff_tabs_events.js
  • ff_tabs_observer.js
  • ff_tabs_tab.js
  • ff_tabs_utils.js
  • ff_traits_core.js
  • ff_utils_data.js
  • ff_utils_object.js
  • ff_utils_registry.js
  • ff_utils_thumbnail.js
  • ff_windows_dom.js
  • ff_windows_loader.js
  • ff_windows_observer.js
  • ff_windows_tabs.js
  • ff_window_utils.js
  • icon128.png
  • icon16.png
  • icon32.png
  • icon48.png
  • icon64.png
  • icon8.png
  • IECore.dll
  • LevelQualityWatcher32.exe
  • LevelQualityWatcher64.exe
  • manifest.json
  • marcopolo.js
  • Microsoft.Deployment.WindowsInstaller.dll
  • Microsoft.Deployment.WindowsInstaller.xml
  • SendJson.dll

It also creates the following registry entries:

  • HKEY_CURRENT_USER\Software\ScorpionSaver
  • HKEY_CURRENT_USER\Software\Adpeak, Inc.
  • HKEY_LOCAL_MACHINE\Software\Classes\clsid\{10AD2C61-0898-4348-8600-14A342F22AC3}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Behavior

Adware:Win32/Adpeak show you extra ads as you browse the Internet, without telling you where these ads are coming from. They might look like this: 

Analysis by Aaron Hulett


Symptoms

The following could indicate that you have this program on your PC:

  • You have this file:
      
    %ProgramFiles%\ScorpionSaver
  • You see these entries or keys in your registry:
     
    HKEY_CURRENT_USER\Software\ScorpionSaver
    HKEY_CURRENT_USER\Software\Adpeak, Inc.
    HKEY_LOCAL_MACHINE\Software\Classes\clsid\{10AD2C61-0898-4348-8600-14A342F22AC3}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
  • You see ads like these:


Prevention


Alert level: High
First detected by definition: 1.165.1158.0
Latest detected by definition: 1.179.1106.0 and higher
First detected on: Jan 04, 2014
This entry was first published on: Jan 28, 2014
This entry was updated on: Aug 21, 2014

This threat is also detected as:
No known aliases