How to Remove SupraSavings Ads & Pop-Ups

by News Editor on July 31st, 2014 in Security Tips.

SupraSavings is a web-browser toolbar that (as per their website advertisement) helps you to save instantly and receive deals with the lowest prices online.


Here is how it works (from SupraSavings EULA):

1.    Displaying advertisements, including without limitation by inserting into web pages, banners, shopping comparison, in-text transitional, in-text link advertisements and coupons that would not otherwise appear;

2.   
Converting words on pages you view into hyperlinks that are linked to advertisements;

3.    Monitoring and recording the domain name of each page you view, the advertisements that appear on these pages, and the advertisements that you click.
Although they have a home page - www.suprasavings.com, you are unable to download this toolbar from here, as the ‘Free Download’ button-link downloads nothing.

Even your trusted websites are full of banners and in-text ads that seem to be a part of your favorite webpage:

 
If SupraSavings is installed on your PC, you will notice overall browser’s slow-down (as it needs more resources to load all the advertisement boxes, and convert random words to underlined in-text links on a website you are currently using).

Several processes and services (some of them are named with a random set of symbols – it is a first sign of suspicious program installed on your PC) automatically start when you launch your computer.

If hidden files were opened on your machine prior to SupraSavings installation, they automatically become hidden again for a user not to see all the files in your system hidden folders that this program brought to the PC. Here are screen-shots with SupraSaving in-text double-underlined ads and banners that you may see in any place of a currently opened webpage. As you can see, a small note that these ads are brought by SupraSavings is located on every ad:


 
New random browser windows can open with strange websites not related to your searches:



Chrome browser is also affected: even if you don’t see SupraSavings in the list of Chrome’s extensions, you will see discount coupons with attractive prices, as well as other banners with non-popular products:



If you want to remove SupraSavings from your PC, please find below step-by-step instructions.

Note. This is a self-help guide. Use it at your own risk. This article is provided "as is" and to be used for information purposes.

1.    Before you start, please make sure you are logged as a system administrator. Also, please save a copy of your important documents/files on an external hard drive.

2.    Please close all your browsers.

3.    From your desktop, click on Windows Start button and choose Control Panel option (Windows 8 users: right-click on ‘Windows Start’   icon (by default, it is located in the left bottom corner of your screen), and choose Control Panel from the context menu):

-    Click ‘Programs and Features’ (Windows Vista, 7 and 8)/‘Add or Remove Programs’ (Windows XP),
-    Find ‘suprasavings’ in the list, right-click on it and choose ‘Uninstall’,
-    Right-click on your desktop task bar and choose ‘Task Manager’ from the context menu,
-    In Task Manager -> ‘Services’ tab, if you find SupraSavingsService(64), and vxlsnyaiet service, right click on these and choose ‘Stop Service’ from the context menu;
-    In the ‘Processes’ tab you may find a process called ‘znjxnhqeua’ – if so, please stop this one as well.


 
4.    Please make sure that hidden files in your Windows Explorer are visible: Start –> Control Panel (Appearance and Personalization) –> Folder Options –> ‘View’ tab –> find ‘Hidden files and folders’ and choose an option ‘Show hidden files, folders, and drives’.

5.    Follow this path - C:\Users\YOUR_USER_NAME\AppData\Local\Temp (XP users: C:\Documents and Settings\YOUR_USER_NAME\Local Settings\Temp) -> highlight all the files/folders here -> press ‘Shift’+’Delete’ and click ‘Yes’ to completely clean this folder (Note. If you receive messages that some files cannot be removed, just skip the file in question).

6.    Please find directories below and make sure all the SupraSavings files/folders are removed (you may not find some of the components, it is normal):

-    C:\Program Files(x86)\003 (or a folder with a random set of symbols that was recently installed and that contains a file called vxlsnyaiet32.exe or vxlsnyaiet64.exe);
-    C:\Program Files(x86)\6E6B36EB-9156-411B-B951-C735F4747DCF (or a folder with a random set of symbols that was recently installed and that contains a file called xkymsyyrfh.dll);
-    C:\Program Files(x86)\suprasavings

7.    Now, please install Ad-Aware to make sure you don’t have any infections on your machine:

•    Click here to download Ad-Aware, and follow installation instructions from Ad-Aware User Guide (‘Installation and Uninstallation’ -> ‘Ad-Aware Install’ section).
•    Perform a full scan of your PC with Ad-Aware (following Ad-Aware User guide: ‘Scanning System’ -> ‘Running a scan’ section).
•    Restart your PC.

8.    Now please make sure that your browser is clean:

Mozilla Firefox
-    Click on the Menu button   in the right upper corner of Firefox window (older versions of browser: click on the orange ‘Firefox’ logo in the upper left corner) -> find Add-ons section -> check ‘Extensions’ and ‘Plugins’ tabs, and if you find SupraSavings extension here, please click on ‘Remove’ button.
-    Restart Firefox.

Internet Explorer
-    When IE window is opened, press Alt+x keys on your keyboard to open Tools menu -> Manage Add-ons -> ‘Toolbars and Extensions’ section -> if you have ‘SupraSavings here, highlight it and click on ‘Disable’ button;
-    In the Privacy tab, ‘Pop-up Blocker’ section you can restrict any pop-ups to appear by checking appropriate button (you can exclude websites you trust using a ‘Settings’ button)
-    Restart Internet Explorer.

Google Chrome

Please note that this browser is not affected with SupraSavings extension, so the above removal steps 1-7 are enough if you are using Google Chrome.

9.    If you still have issues with this program, please remove SupraSavings traces from your registry. Before you start, please make sure you understand how important this part of your PC is. You cannot restore data from here once you delete something (‘Ctrl+Z’ never works in Registry Editor). And if you delete an incorrect component by mistake, it may damage your OS and make it unusable.

•    To open the Registry, press ‘Win+R’ keys on your keyboard -> in the opened window type regedit and press ‘Enter’.
•    Highlight main registry section called ‘Computer’ -> press Ctrl+F keys on your keyboard -> make sure Keys, Values, Data check-boxes in the ‘Find’ window are checked -> type suprasavings in the search field and click OK. Search results will highlight a key/value/data that contains SupraSavings components. If you find the exact match with the name of program you want to remove, right click on the element in question and choose ‘Delete’ from the context menu. If it’s a value/data, right click on the value and choose ‘Modify’, then highlight harmful data and press ‘Delete’ key on your keyboard.
•    Use F3 key to continue the search and to find all the necessary files.
•    Repeat the above procedure with the following key-words: vxlsnyaiet, znjxnhqeua
•    Exit the registry editor.
•    Reboot your PC.

Lastly, it is recommended to always keep your antivirus program up-to-date with a real-time protection turned on, and perform weekly full scans to stay protected at all times.