Follow:

 

Adware:Win32/CostMin


Microsoft security software detects and removes this potentially unwanted software.

This adware program shows ads as you browse the web. These ads don't tell you the name of the program that is showing them to you.

You can see examples of these ads on the Technical information tab.

It can be downloaded from the program's website or bundled with some third-party software installation programs.

Find out more about how and why we identify potentially unwanted software.



What to do now

This program poses a high threat to your PC.

This program may create an uninstaller that can be accessed from the Control Panel. Running this uninstaller may remove some or all of the files related to the program:
  • For Windows 8.1, open the Start screen, type Uninstall and then go to Settings. In the search results, go to Uninstall a program.
  • For Windows 7 and Vista, open the Start menu and navigate to Control Panel then Programs and then Uninstall a Program.
  • For Windows XP, open the Start menu and navigate to Control Panel then Add or Remove Programs.

Choose the program you want to remove, and then click or tap Uninstall or Uninstall/Change and follow the prompts.

The entry for this program may be called "costmin", "SaveClicker", "Shopping Chip"or "Costmin Addon".

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other potentially unwanted software from your PC:

You can also visit the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

Installation

This program is usually installed by an installer, which is detected as SoftwareBundler:Win32/CostMin.

The installer for program is usually found in the %TEMP% folder with any of these file names:

  • 18be6784_.exe
  • 294823_.exe
  • pl2352030c.fyt
  • pl3a3c6f9c.fyt

Ths program can be downloaded from certain servers, like:

  • download.costmin.info
  • download.saveclickersoft.info
  • installcollection.com
  • support.costmin.info
  • support.saveclickersoft.info

This program adds a plug-in to Internet Explorer, Firefox, and Chrome:

When it's installed, it creates the following files and folders:

  • %ALLUSERPROFILE% \CostMin
  • %APPDATA% \Mozilla\Firefox\Profiles\????????.default\extensions\51d15c58d6f18@51d15c58d6f51.com
  • %APPDATA% \Mozilla\Firefox\Profiles\????????.default\extensions\ath-4txop@jxsqdueil.net
  • %LOCALAPPDATA% \Google\Chrome\User Data\Default\Extensions\epbobadpdjhmhnnokljfjbmjbjkkamic
  • %ProgramFiles% \CostMin
  • %USERPROFILE% \AppData\Loclet\{6F55A296-E5BC-A3C0-35AD-973ABC6AB009}
  • C:\Users\All Users\CostMin
Behavior

Adware:Win32/CostMin shows you ads as you browse the Internet, as shown in the following examples:


Analysis by Michael Johnson


Symptoms

The following could indicate that you have this program on your PC:

  • You see ads appear in your Internet browser that weren't there before

Prevention


Alert level: High
First detected by definition: 1.171.46.0
Latest detected by definition: 1.179.2907.0 and higher
First detected on: Apr 16, 2014
This entry was first published on: Apr 16, 2014
This entry was updated on: Jul 09, 2014

This threat is also detected as:
No known aliases