Savingscool Proxy Hijack

If you see intrusive, annoying coupons while you are browsing the web, then your PC might have been infected with Savingscool Proxy Hijack, an adware-type application dedicated to rendering coupons and showing various promotions. It is recommended that you remove this good for nothing program because all it can do is show unwelcome advertisements. This application can end up on your PC accidentally because its creators distribute it. We have classified this program as potentially unwanted as it is next to useless but does not fall into the category of malware. Please continue reading to find out more about it.

As far as this program’s dissemination channels are concerned, we have found that its developers use two channels. Savingscool Proxy Hijack has a dedicated distribution website at Savings.cool which we think should have featured its download. However, at the time of our research, this website did not work, so it is unknown if it actually featured this program’s download. In any case, we believe that the distribution website did not generate many downloads because we have no information on whether this site was at all promoted. The second known distribution channel is software bundling. We have concluded that this program’s developers work with shady freeware distributing sites that include Savingscool Proxy Hijack in software bundles and it can be installed along with the rest of the software on that particular bundle without your knowledge or authorization. Nevertheless, some bundled installers can allow you to deselect the installation of this program after selecting custom/advanced installation settings.

If Savingscool Proxy Hijack gets installed on your PC accidentally, then you should know that its main objective is to show various promotional coupons that will appear in your browser’s window while you browse the web. The coupons can be rather annoying and intrusive, but our biggest concern is the possibility of those coupons promoting malicious content such as fake online shopping websites, clone websites that extract login credentials, malware infested websites, and so on. This program’s developers make money off clicks, so they have an interest in providing you with the most relevant advertisements.

Therefore, we believe that this program may have been configured to collect some non-personally identifiable information about you and use it for geotargeting purposes to present you with region-specific and somewhat personalized ads. The potentially collected information may include your IP address, approximate location, browser type, operating system type, language preferences, and so on. The collection of this information is not illegal, but given that this program is unreliable, you may not want to share information with its developers.

Testing has shown that Savingscool Proxy Hijack runs ads through a service called “wcmasc.exe (32bit)”. Testing has shown that this program was set to drop its files in %ALLUSERSPROFILE%\boost_interprocess, %ALLUSERSPROFILE%\Microsoft\Windows\WindowsCredentialManager, and %AppData%\Roaming\Windows\SavingsCool. Furthermore, it adds necessary registry keys at HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SavingsCool, HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SavingsCool, HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SCTab, and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wcmasc. All of these files and keys make Savingscool Proxy Hijack tick, and you have to delete all of them to get rid of the annoying and potentially dangerous coupons.

While Savingscool Proxy Hijack is not a highly malicious application, it does contain an element of risk because there is no telling what it will promote next. The bottom line is that you probably got it accidentally and, therefore, you may want to remove it. Please see the guide below on how to delete this program because its uninstaller does not work. We also advise scanning your PC with an antimalware program to make sure your computer’s security has not been compromised by more malware.

How to delete Savingscool Proxy Hijack

1. Press Windows+ E keys.
2. Enter the following file paths in the File Explorer’s address box and press Enter.
   • %ALLUSERSPROFILE%\boost_interprocess
   • %ALLUSERSPROFILE%\Microsoft\Windows\WindowsCredentialManager
   • %AppData%\Roaming\Windows\SavingsCool
3. Delete the contents of the folders.
4. Empty the Recycle Bin.

How to delete the related registry subkeys

1. Press Windows+R keys.
2. Type regedit in the dialog box and press OK.
3. Navigate to the following registry sub keys.
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SavingsCool
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SavingsCool
   • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SCTab
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wcmasc
4. Delete the SavingsCool, SCTab, and wcmasc subkeys.
5. Close the Registry Editor.