Your computer is infected with malicious software? Do you have pop-ups on your PC?
If so, search this blog for removal instructions or browse computer threats by category.

Saturday, December 6, 2014

How to Remove BuyNSave Malware (Uninstall Guide)

Tell your friends:
BuyNSave has been designed to display adverts on your PC. BuyNSave Ads or "Ads by BuyNSave" appear on every web page you visit. They are injected by malicious web browser extensions called BuyNSave. While some people do refer to BuyNSave as a virus or as malware, there are a number of differences. Unlike the latter two, BuyNSave is not always harmful and is frequently used in legitimate circumstances. Put simply, it's adware which has been designed to automatically display, download, or play adverts on your computer. These advertisements exhibit themselves in a number of different ways. They may be banner adverts - the usually large and eye catching ads that appear at the top of, or sometimes the side of, your screen. They can also be in the form of pop up adverts - windows that flash up on your screen without warning. They may even be the less immediately noticeable pop under adverts which hide behind the screen you're currently looking at, waiting for you to close the window before they reveal themselves.

It becomes apparent, especially if you have been infected by BuyNSave, that these adverts, whatever size and shape they are, have one thing in common, and that is they very quickly become very annoying.

So who creates this adware - and why? Well, like any form of advertising or marketing, BuyNSave has been created to generate revenue for its author, and sometimes for a third party too. Normally, despite being bothersome, it on its own is technically not dangerous. But that doesn't mean you should dismiss it merely as a distraction for some types of adware will have been designed to include spyware. And that is something you can really do without on your computer. The problem with spyware is that it does exactly what it says on the can, as the saying goes: it spies on you. It will watch which websites you visit, note which products or services you are looking at and then record this data and send it back to the programmer who will then either (best case scenario) send you adverts that are tailored towards your browsing habits, or (worst case scenario) sell your information on to a third party.

Even more scary is the inclusion of keyloggers in some spyware. These have been designed to actually record the keys you are typing on your desktop or laptop's keyboard. And it doesn't take a genius to figure out that this data is not just going to include the gossipy instant message you sent to a co-worker or the birthday greetings you sent via email to your grandma, but all the other things you type into your computer on a daily basis: your personal details, your passwords, your credit card information and so forth. The good news is however that BuyNSave is not that kind of adware. It cannot steal your passwords and personal details.

Therefore, if you've ever been tempted to dismiss adware as a relatively minor vexation when you're using your computer, you may want to think again. BuyNSave is a pain in the neck, that cannot be denied, but it can also leave you vulnerable to far more serious issues.

Protect yourself from the irritation of having to deal with endless BuyNSave pop up ads and from the extreme stress caused by having to deal with stolen passwords and hacked accounts by installing a reputable anti-malware software program today. Oh, and when we say today - we actually mean as soon as you've finished reading this article!

To remove BuyNSave and stop annoying ads, please follow the steps in the removal guide below. If you have any questions, please leave a comment down below. Good luck and be safe online!

Written by Michael Kaur,

BuyNSave Ads Removal Guide:

1. First of all, download anti-malware software and run a full system scan. It will detect and remove this infection from your computer. You may then follow the manual removal instructions below to remove the leftover traces of this malware. Hopefully you won't have to do that.

2. Remove BuyNSave related programs from your computer using the Add/Remove Programs control panel (Windows XP) or Uninstall a program control panel (Windows 7 and Windows 8).

Go to the Start Menu. Select Control PanelAdd/Remove Programs.
If you are using Windows Vista or Windows 7, select Control PanelUninstall a Program.

If you are using Windows 8, simply drag your mouse pointer to the right edge of the screen, select Search from the list and search for "control panel".

Or you can right-click on a bottom left hot corner (formerly known as the Start button) and select Control panel from there.

3. When the Add/Remove Programs or the Uninstall a Program screen is displayed, scroll through the list of currently installed programs and remove the following:
  • BuyNSave
  • and any other recently installed application

Simply select each application and click Remove. If you are using Windows Vista, Windows 7 or Windows 8, click Uninstall up near the top of that window. When you're done, please close the Control Panel screen.

Remove BuyNSave related extensions from Google Chrome:

1. Click on Chrome menu button. Go to ToolsExtensions.

2. Click on the trashcan icon to remove BuyNSave, MediaPlayerV1, HD-Plus 3.5 and other extensions that you do not recognize.

If the removal option is grayed out then read how to remove extensions installed by enterprise policy.

Remove BuyNSave related extensions from Mozilla Firefox:

1. Open Mozilla Firefox. Go to ToolsAdd-ons.

2. Select Extensions. Click Remove button to remove BuyNSave, MediaPlayerV1, HD-Plus 3.5 and other extensions that you do not recognize.

Remove BuyNSave related add-ons from Internet Explorer:

1. Open Internet Explorer. Go to ToolsManage Add-ons. If you have the latest version, simply click on the Settings button.

2. Select Toolbars and Extensions. Click Remove/Disable button to remove the browser add-ons listed above.


Anonymous said...

this doesnt work

Anonymous said...

Agree with previous comment!

Anonymous said...

It Worked!!!! thank you so much

Anonymous said...

BuyNsavve i removed from Google Chrome extensions but when we open again Google Chrome then still showing this extensions kindly suggest how can i remove permanentaly

Anonymous said...

keeps coming back with Google Chrome.I ended up with just disabling the extension instead of trashing. That does not remove the virus though, but at least it prevents annoying ads

Bolaris said...

Yo, switched on developer mode in extensions. Upon reloading of chrome and then opening up extensions. It then displays info of where the extension is being loaded from. Clicked the pathway hyperlink and deleted the folder and its contents. Was just a file named with random letters. Removed it and have not had that friggin thing come back yet. Hope this helps.

Anonymous said...


this one solved my problemmmm,,,,,,,,,,,,, permantly

Anonymous said...

Thank you so much Bolaris!! What you said worked when nothing else was working

Yaakov A Sternberg said...

I too had trouble getting it out of chrome - I finally did, but i did several things, so i don't know what did the trick. If (one of) these methods do/don't work for u, post your results for the benefit of other readers.

Here's what I did:

I booted up into Safe mode (with networking - so i could work online during scans)

And ran the following:
(Note: Due to the nature of the problem, it is advisable to be extra careful that you are downloading, the desired program and not more malware disguised as useful tools.)
MBAM - Threat Scan
(In settings i chkd off: scan for rootkits & self protection module (in addition to default settings).
(In settings i cleared/removed any 'malware exclusions')
Super Anti-Spyware
Spybot Search and Destroy 2 - Ran both systemc scan & rootkit scan)
Zoek (Didn't even finish, stopped after 'Delete Services')

I also used windows explorer to search for the terms: 'BuyNSave' & 'unisalees'.
The search for 'unisalees' brought up one result - C:\Program Files (x86)\unisalees, which I was unable to delete, so i just deleted the file(s) inside.

If you've tried (some of) these methods, please leave a comment detailing what you did and what did/didn't work. Your comments may help others experiencing similar issues.

Enhbat.B said...

Thanks Bolaris, it worked.

MalwareBytes couldn't do it.

Miela said...

Thanks Bolaris! Was irritating the CRAP out of me!