Did an extension called EverSave suddenly appear in your browser? Follow our removal instructions to get rid of EverSave.
EverSave is a virus of the Adware variety, which are the most commonly spear out type of viruses in existence. Viruses like EverSave are characterized by their ability to relentlessly pepper you with advertisements until EverSave is removed. These advertisements (Ads for short) can take many different shapes and abilities. For starters the virus will generate a new page filled with Ads every time you start your browser or open a new tab/page yourself. It can also have the ability to transform different random words into hyperlinks that lead to pay sites – just another form of Ads. On rare occasions EverSave has also been known to install unwanted toolbars or even mess with the default search engine on the browser.
If you are reading this article then you have probably already decided to remove this thing – and for good measure. Specialists dub Adware the least dangerous type of viruses due to their limited ability to directly harm your computer, but they should nevertheless never be underestimated.
The Ads themselves are harmless, the danger is hiding behind their back
There is no way to know if any sites linked by the Ads is a real reseller or a fake copy-cat that only aims to rob your wallet. The fakes will often impersonate actual and popular internet sites by copying their design and using very similar URL – likely with only a character or two in difference. Thus it’s never a good idea to spend moneys on such sites and therefore no point on clicking on the Ads. Ever.
A more dangerous situation occurs if you download and install a file offered by EverSave through one of its Ads. As above you can’t be sure if you are getting something legitimate or the file will actually be an infected executable containing a virus.
Most viruses use similar tricks to infect computers
Whether its an Adware like EverSave or another virus – the ways they come in are usually not that different – and they almost always use the user’s authority to override the security of your computer.
One such way are files downloaded from torrents or free hosting sites. These files are not safe. If the file itself is not infected then you might also fall victim to a fake download button. You might see several of those buttons on the site. Clicking on the wrong button will result in a download window, which will contain a file named like the thing you want, but with a file extension .exe and actually a virus.
Another less known trick are the so-called program bundles. Those are installers that can install more then one program when they are ran. The extras are supposed to be demos and trial version of programs, but in some cases they might be viruses. Don’t use the default installation – use advanced so you can control what is getting installer. Remove any unwanted extras from the list.
Our first step here is a reboot in Safe Mode. If you already know how to do it, just skip this and proceed to Step 2. If you do not know how to do it, continue reading:
For Windows 98, XP, Millenium and 7 Users:
Restart your computer. To be sure you don’t miss the time when you need to press it, just spam F8 as soon as the PC starts booting. In the new menu, choose Safe Mode With Networking.
Proceed to Step 2.
For W. 8 and 8.1 Users:
Click the Start button , then Control Panel —> System and Security —> Administrative Tools —> System Configuration.
Then check the Safe Boot option and click OK. Click Restart in the new pop-up.
Proceed to Step 2.
For OS X Users:
When you Mac is turned off, press the Power Button. After you hear the Startup Sound, immediately press and hold the Shift key until the Apple logo appears.
Proceed to Step 2.
EverSave has infected ALL of your browsers. Apply the steps separately for each one.
For Internet Explorer Users:
Open IE, then click —–> Manage Add-ons.
Find EverSave . Disable it.
If your Home Page is different from the usual, click —–> Internet Options>edit the URL box with your preferred search engine, and click Apply.
For Mozilla Firefox Users:
Open Firefox, click on (top right) ——-> Add-ons.
Hit Extensions next.
EverSave should be somewhere around here – Remove it.
For Google Chrome Users:
Start Chrome, click —–>More Tools —–> Extensions.
In Extensions, find the virus and select .
Click again, and proceed to Settings —> Search (the fourth tab), select Manage Search Engines. Remove anything but the search engines you normally use.
For Safari Users:
Open Safari, and click Safari —–>Preferences —–> Extensions—–>Uninstall the malware.
(Works for Windows XP, 7, 8, 8.1)
You are now in the Control Panel. Search around for EverSave and anything else suspicious-looking. Uninstall it/them. Also, be extremely careful. Viruses often spend one last ditch effort to trick you into installing more of their kind. If you see a screen like this when you click Uninstall, choose NO:
This is perhaps the most important and difficult step, so be extremely careful. Open the Task Manager by right clicking on the Taskbar and choosing Start Task Manager.
Once it opens, choose the Processes Tab. Look at all of the processes in front of you and try to determine which ones are a virus. Google them or ask us in the comments and we will provide the best assistance we can. If the virus returns later on, the reason is that you missed something here. However, we should warn you – doing this can be extremely risky, so the best course is to seek assistance from us.
Right click on each of the virus processes separately and select Open File Location. Also, End the process after you open the folder. Just to make sure we don’t delete any programs you mistakenly took for a virus, copy the folders somewhere, then delete the directories you were sent to.
We’ve had reports that this virus can come back after you uninstall it. This usually takes place on system boot. If this happens, do the following:
Type Regedit in the windows search field and press Enter.
Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. Alternatively, if you can’t find any this way, look in these directories, and delete the registries manually:
- HKEY_CURRENT_USER—-Software—–Random numbers
HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random
STEP 6 – Optimization
And that’s it. Well done for removing EverSave. We’ve prepared a short and sweet optimization guide, specifically designed for users who just removed a virus. It is completely free, you do not need to download anything, and it’s not very time consuming. If you are interested, you can check it out here.