Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 6 subscribers
  • Views 8038 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to remove 'saveshare'?

Elisa1

Hi there,

I downloaded VLC to read some divx files a few days ago, and it brought 'saveshare' malware with it in the download as well. (At least, I think that's where it came from.)

I've removed saveshare from my Firefox add-ons, but that hasn't stopped the ads or the annoying links sprinkled randomly through the text of any web page I'm looking at. The Firefox add-on wasn't actually called 'saveshare' - it was something similar, but I deleted it before I thought of looking for that file name in my system.

I had hoped Sophos would be able to find it for me, but it's scanned my whole system and only found 'issues' rather than threats. Is there any way I can direct it to find the problematic files?

Will uninstalling VLC do anything to help?

Thanks,

Elisa.

:1013915


This thread was automatically locked due to age.
Parents
  • 0

    Hi Christian, Thanks for replying. I downloaded VLC from videolan.org, so perhaps that wasn't the culprit... And I'm using version 9 of Sophos.

    Here's the weird thing, though - I went to bed after I posted my question last night, and have been at work all day today away from my laptop. When I came back tonight to work through your suggestions, Firefox appears to be running completely cleanly! I have done literally nothing since closing it down yesterday. (And I closed everything down a bunch of times when I was first trying to get rid of the problem, so it's not like that's what's done it.)

    Anyway... I searched through the prefs.js file, and found two instances of user_pref("extensions.xxxxxxxxxxxx.scode" code. You think I should still delete them? I'm not fluent in JavaScript, so I might need a hand working out where the problematic lines end. Screenshots attached...

    Screen shot 2013-10-25 at 7.39.07 PM.png

    Screen shot 2013-10-25 at 7.42.13 PM.png

    Thanks for your help.

    Cheers,

    e.

    :1013951
Reply
  • 0

    Hi Christian, Thanks for replying. I downloaded VLC from videolan.org, so perhaps that wasn't the culprit... And I'm using version 9 of Sophos.

    Here's the weird thing, though - I went to bed after I posted my question last night, and have been at work all day today away from my laptop. When I came back tonight to work through your suggestions, Firefox appears to be running completely cleanly! I have done literally nothing since closing it down yesterday. (And I closed everything down a bunch of times when I was first trying to get rid of the problem, so it's not like that's what's done it.)

    Anyway... I searched through the prefs.js file, and found two instances of user_pref("extensions.xxxxxxxxxxxx.scode" code. You think I should still delete them? I'm not fluent in JavaScript, so I might need a hand working out where the problematic lines end. Screenshots attached...

    Screen shot 2013-10-25 at 7.39.07 PM.png

    Screen shot 2013-10-25 at 7.42.13 PM.png

    Thanks for your help.

    Cheers,

    e.

    :1013951
Children
No Data