{"id":3076,"date":"2014-11-20T21:51:19","date_gmt":"2014-11-20T21:51:19","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=3076"},"modified":"2018-05-29T12:01:49","modified_gmt":"2018-05-29T12:01:49","slug":"remove-buynsave-and-brickprovider","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/remove-buynsave-and-brickprovider\/","title":{"rendered":"Remove BuyNSave and BrickProvider Adware"},"content":{"rendered":"

Just wanted to write a short blog post before going back to coding. I just found another bundled adware<\/strong> called BuyNSave \/ BrickProvider<\/strong> and give you some removal instructions<\/strong>. If you got BuyNSave \/ BrickProvider on your computer, you will see BrickProvider.exe<\/strong> running in the Task Manager, an add-on named BuyNSave added into Internet Explorer and Mozilla Firefox and a new scheduled task called BrickProvider. Chrome dodged the adware. I’ll show how to remove BuyNSave \/ BrickProvider in this blog post with the FreeFixer removal tool.<\/p>\n

Here’s BrickProvider.exe in the Task Manager:<\/p>\n

\"BrickProvider.exe<\/a><\/p>\n

BuyNSave add-on in Firefox:<\/p>\n

\"BuyNsave<\/a><\/p>\n

And BuyNSave in Internet Explorer:<\/p>\n

\"BuyNSave<\/a><\/p>\n

BuyNSave \/ BrickProvider is bundled<\/strong> in other software’s installers. Here’s how it was disclosed in the installer where I found it:<\/p>\n

\"BuyNSave<\/a><\/p>\n

 <\/p>\n

YouTubeAdBlocke<\/a> was also included in the installer.<\/p>\n

As always when I find some new bundled software I uploaded it to VirusTotal to test if the anti-malwares there find something. The detection rate is 11\/55. Malwarebytes classifies BuyNSave \/ BrickProvider as PUP.Optional.MultiPlug<\/strong>, McAfee-GW-Edition calls it BehavesLike.Win32.PWSYunsip.bm<\/strong> and Qihoo-360 calls it HEUR\/QVM30.1.Malware.Gen<\/strong>.<\/p>\n

\"BuyNsave<\/a><\/p>\n

If you’d like to remove BuyNSave \/ BrickProvider you can do so with the FreeFixer<\/a> removal tool. Just check the BuyNSave \/ BrickProvider files as the screenshots below shows. You may have to reboot your computer to complete the removal.<\/p>\n

\"BuyNSave<\/a> \"BrickProvider.exe<\/a> \"BrickProvider.exe<\/a> \"BuyNsave<\/a><\/p>\n

Hope that helped you with the removal.<\/p>\n

I stumbled upon BuyNSave \/ BrickProvider while testing out some downloads that are known to bundled lots of unwanted software. Any idea how BuyNSave \/ BrickProvider was installed on your system? Please share by posting a comment. Thank you!<\/p>\n

Hope you found this useful and thanks you for reading.<\/p>\n

Update 2014-11-21<\/strong>: Found some variants that don’t use the\u00a0BrickProvider name. Instead they are called:<\/p>\n

BrickProlonger<\/strong> &\u00a0SoftwareProlonger<\/strong>.\u00a0SoftwareProlonger.exe<\/strong> shows up in the Task Manager. The file is located in\u00a0c:\\programdata\\trusted publisher\\softwareprolonger.<\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Just wanted to write a short blog post before going back to coding. I just found another bundled adware called BuyNSave \/ BrickProvider and give you some removal instructions. If you got BuyNSave \/ BrickProvider on your computer, you will see BrickProvider.exe running in the Task Manager, an add-on named BuyNSave added into Internet Explorer … Continue reading Remove BuyNSave and BrickProvider Adware<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,16],"tags":[],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3076"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=3076"}],"version-history":[{"count":5,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3076\/revisions"}],"predecessor-version":[{"id":3120,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/3076\/revisions\/3120"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=3076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=3076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=3076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}