How to remove Save-window.com ads

Save-window.com is a fake website that imitates antivirus scan processes to mislead users

There are thousands of scam websites that try to make people believe their systems are infected with malware so that a fake security application would be downloaded and installed. Save-window.com is one of the websites that operate in such a manner – it imitates a fake system scan of McAfee security software by using logos and pop-up windows that are distinctive to this security vendor.

Once the scan is complete, users are shown “results,” which claim that the system has been infected and needs to be cleaned with the said security software. Save-window.com scan results are undoubtedly fake, and you should not download any software promoted through the site.

Upon entry, you might also be asked to enable push notifications in a pop-up prompt shown at the top left of the page. If you click the “Allow” button either intentionally or accidentally, you will allow the site to send you push notifications at any time when the browser is running. This would result in more intrusive ads even when visiting unrelated sites.

Also, those who suffer from frequent redirects to suspicious websites or encounter ads everywhere are likely to have adware^[1] installed on their systems. Regardless of which actions you took, we will explain how to deal with this situation correctly – follow the steps below.

Scam methods

Fear is a powerful emotion, hence many online fraud campaigns are directed toward it. When users aren't quite sure how viruses and the infection process work, they tend to get scared when shown misleading messages claiming that viruses have been found on their machines. For this to work better, scammers often employ well-known company names such as Google, Microsoft, or, in this case, security vendor McAfee.

In this social engineering^[2] scheme, users are shown a fake security scan that is triggered as soon as they are redirected to Save-window.com from another website. They are caught off guard whenever they are shown the following message:

Your PC is infected with 5 viruses!

ACTION REQUIRED

Your McAfee Subscription Has Expired!
Renew now to keep your PC protected.
If your PC is unprotected, it is at risk for viruses and other malware.

Those who believe this message is more likely to proceed with the offered solution for a problem that actually unlikely to exist. Websites can not determine whether or not your device is infected – special anti-malware software is required for this job. Thus, whenever you see a message which claims malware infection, ignore it and leave the page immediately.

By downloading this software, you are supporting scammers who receive the commission for every download made. Also, the offered software might not be legitimate or malware in disguise. Never provide your personal details or download apps from scam websites.

Check your device for infections

When it comes to malware and potentially unwanted programs such as adware, these programs can cause significant changes within the operating system. They also tend to run rather stealthily and insert various components all across the system, running background processes or not displaying any active windows, making it difficult for the affected users to spot and remove these infections.

Therefore, we recommend you first run a scan with powerful anti-malware software, such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, to make sure that all the most malicious programs and their components are deleted at once. Likewise, if you have downloaded the software offered on Save-window.com, your machine could also be infected (even if it looks like a legitimate McAfee antivirus).

When it comes to potentially unwanted programs, you can find them installed on the system level or appended as an browser extension. Strat from finding unwanted programs as follows:

Windows

• Enter Control Panel into the Windows search box and hit Enter or click on the search result.
• Under Programs, select Uninstall a program.
• From the list, find the entry of the suspicious program.
• Right-click on the application and select Uninstall.
• If User Account Control shows up, click Yes.
• Wait till the uninstallation process is complete and click OK.

Mac

While moving apps into Trash is how you delete most normal applications, adware tends to create additional files for persistence. Thus, you should look for .plist and other files that could be related to the virus. If you are not sure, skip this step entirely.

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Clean your browsers

Your next step is to check your device for unwanted browser extensions, which can be easily found by pressing the “Extensions” (or equivalent) button to the right of the URL bar. Remove everything you don't recognize by pressing “Uninstall.”

Once done, you should take your time and clean your browsers from cookies^[3] and other web data. This would prevent unwanted data tracking that could occur even after adware or other malicious software is removed, as cookies might remain present locally for years. To remove this web data, you could employ FortectIntego maintenance utility or follow the steps below:

Google Chrome

• Click the Menu and pick Settings.
• Under Privacy and security, select Clear browsing data.
• Select Browsing history, Cookies and other site data, as well as Cached images and files.
• Click Clear data.

Mozilla Firefox

• Click Menu and pick Options.
• Go to Privacy & Security section.
• Scroll down to locate Cookies and Site Data.
• Click on Clear Data…
• Select Cookies and Site Data, as well as Cached Web Content and press Clear.

MS Edge (Chromium)

• Click on Menu and go to Settings.
• Select Privacy and services.
• Under Clear browsing data, pick Choose what to clear.
• Under Time range, pick All time.
• Select Clear now.

Safari

• Click Safari > Clear History…
• From the drop-down menu under Clear, pick all history.
• Confirm with Clear History.

Get rid of notifications

Push notifications can be used by both legitimate and illegitimate websites. Wen subscribed to Save-window.com push notifications, you might start receiving intrusive pop-up ads, irrespective of which websites are being visited at the time. These ads can include links to various malicious websites, so clicking them is not recommended.

Luckily, removing these pop-ups is rather an easy task, as all you have to do is block the address that is triggering push notifications. This can be done in the settings of the web browser.