Follow:

 

Adware:Win32/CostMin


Microsoft security software detects and removes this unwanted software.

This adware program shows ads as you browse the web. These ads don't tell you the name of the program that is showing them to you.

You can see examples of these ads on the Technical information tab.

It can be downloaded from the program's website or bundled with some third-party software installation programs.

Find out more about how and why we identify unwanted software.



What to do now

This program poses a high threat to your PC
Remove programs

You might need to manually remove this program:

The entry for this program might be called "costmin", "SaveClicker", "Shopping Chip"or "Costmin Addon".

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other unwanted software from your PC:

You should also run a full scan. A full scan might find hidden threats.

Get more help

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Installation

This program is usually installed by an installer which is detected as SoftwareBundler:Win32/CostMin.

The installer for this program is usually found in the %TEMP% folder with any of these file names:

  • 18be6784_.exe
  • 294823_.exe
  • pl2352030c.fyt
  • pl3a3c6f9c.fyt

This program can be downloaded from certain servers, including:

  • download.costmin.info
  • download.saveclickersoft.info
  • installcollection.com
  • support.costmin.info
  • support.saveclickersoft.info

This program adds an extension to Internet Explorer, Firefox, and Chrome:

When it's installed, it creates the following files and folders:

  • %ALLUSERPROFILE% \CostMin
  • %APPDATA% \Mozilla\Firefox\Profiles\????????.default\extensions\51d15c58d6f18@51d15c58d6f51.com
  • %APPDATA% \Mozilla\Firefox\Profiles\????????.default\extensions\ath-4txop@jxsqdueil.net
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\epbobadpdjhmhnnokljfjbmjbjkkamic
  • %ProgramFiles% \CostMin
  • %USERPROFILE% \AppData\Loclet\{6F55A296-E5BC-A3C0-35AD-973ABC6AB009}
  • C:\Users\All Users\CostMin
Behavior

This adware shows you ads as you browse the Internet, as in the following examples:


Analysis by Michael Johnson


Symptoms

The following could indicate that you have this program on your PC:

  • You see ads appear in your Internet browser that weren't there before

Prevention


Alert level: High
First detected by definition: 1.171.46.0
Latest detected by definition: 1.189.904.0 and higher
First detected on: Apr 16, 2014
This entry was first published on: Apr 16, 2014
This entry was updated on: Nov 20, 2014

This threat is also detected as:
No known aliases