Exterminate It! Antimalware

malpedia

Known threats:684,359 Last Update:October 15, 11:35

Testimonials

Every contact I have had with Exterminate It! team has been at the level of customer support that I expect or greater.

Arcelia T.

File: helper-sig@savefrom.net.xpi

Location of helper-sig@savefrom.net.xpi and Associated Malware

Check whether helper-sig@savefrom.net.xpi is present in the following locations:

Windows 2000, Windows XP, Windows Server 2003 specific helper-sig@savefrom.net.xpi file locations:

  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\wngnrwd2.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\mozilla\firefox\profiles\[%PROFILE_FOLDER%]\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\2cho8jv1.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\2mbwbj0f.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\4rtckbrj.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\33r6xgy1.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\bp1uik3v.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\9pwzxt6g.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\n3n58ddy.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\5r1wuhbe.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\hh0vqfgw.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Documents And Settings\USER_NAME\Application Data\Mozilla\Firefox\Profiles\huxcdpam.default-1464707667838\extensions\helper-sig@savefrom.net.xpi

Windows Vista, Windows Server 2008, Windows 7, Windows 8 specific helper-sig@savefrom.net.xpi file locations:

  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\wngnrwd2.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\mozilla\firefox\profiles\[%PROFILE_FOLDER%]\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\2cho8jv1.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\2mbwbj0f.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\4rtckbrj.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\33r6xgy1.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\bp1uik3v.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\9pwzxt6g.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\n3n58ddy.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\5r1wuhbe.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\hh0vqfgw.default\extensions\helper-sig@savefrom.net.xpi
  • C:\Users\USER_NAME\AppData\Roaming\Mozilla\Firefox\Profiles\huxcdpam.default-1464707667838\extensions\helper-sig@savefrom.net.xpi
IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The helper-sig@savefrom.net.xpi file is associated with malware only if found in the locations listed above.

Notes:

Different Variations of helper-sig@savefrom.net.xpi File^

File SizeFile Md5Last Seen
26898349CF61C671BF96291049024973F7B562Oct 13, 2015
340454540A7CE2A99AB4ED274E6BE3009381A8Nov 22, 2015
359942F02915003C5B1F8B9A2130B8AB162CD2Dec 15, 2015
3560407FCA7A09B63344333114D3133C5B92D0Dec 19, 2015
3559012C21C57E955D4CEF8C157BCE159611E9Jan 4, 2016
32994063DF9209106A0A8903B8B482DB493AEDJan 5, 2016
3627797A1F5241ADBAF84D824EB6889703E20BJan 10, 2016
3373389036215466A277F2354A2EAB906C1A89Feb 15, 2016
356140478B1BEA09E386CE702231866A084511Feb 16, 2016
4721768B2B411720AB7CE451D9075F867842E7May 14, 2016
3058157D478E9DC20734D3A8DC0AF83331D4AFMay 15, 2016
340389B73A63AD94F44D1B9DC036B9306641FDMay 19, 2016
3525868AD9E9423C41DC6E29D6B1947D6D004CMay 28, 2016
327822ECF2CEEDB0CF32A793D0E737386971C6Jun 3, 2016
3689582D0D5F004E282C83219A24D06FB8B598Jun 8, 2016
354063BC8F409A5F8F6FB86D59CBD12733177CJun 12, 2016
619236804BC819AD45F2B5AA252FB332B7921BJun 27, 2016
3645053A1FD6BD5F14C5D3DA208C81653393ECJul 4, 2016
6181020B3923C3B27C72A401078F6EB4779753Jul 19, 2016
6206560B52C750BF756A45713969D6E3108657Aug 31, 2017
61974943FD0D194518E3CE82A90B9320DA8CAFAug 8, 2016
30911546205266FE8579E4838A57353017EFA8Oct 18, 2016
58018900CA7A2D5E6313435AF31281D58930E1Nov 9, 2016
6119943FCA5AC56C5627D746901DF64094DCC5Nov 17, 2016
359993FA3C2C9254B9952891D4B4B05C2DBDD0Dec 6, 2016
558932BA8BCF0C80C66DD6AFEDADA5B89B8155Dec 20, 2016
5590811CFCFC804EAA204DC282E0DE53129379Jan 4, 2017
362038A24C3333CEFAF6ACD69344010C777970Jan 30, 2017
362166D17A89CB54806519C284803B2B9BF71AJan 31, 2017
611558215909DE39DF002E6D9C470514E1EEDCFeb 2, 2017
36140965466CD16E65ABA5886D78E44E6BF165Feb 13, 2017
360576C92492DB39B13D0D5CC91EACD2844094Feb 13, 2017
55987964847648848AFC6903DEE661C0D978F8Mar 19, 2017
362796D0E06EE6282A3E80EC0E3C129B15B131Mar 22, 2017
529417E312A50CDAFB5229F55C0457B654DC8EApr 2, 2017
332855B5D75A1F5A8DC2891455C16A7FEDCEA5Apr 4, 2017
564924DBA033731E911C9BE5FAB83BDC89CE7EApr 10, 2017
560475895B88EB751B0C7C1D9595C0DC2013C8Aug 21, 2017
562223D5BE5AAB6636F12E9AEB24400188FC61Apr 24, 2017
472228889814E9BFC5C2F5FC3A2D1C677C4E53Jul 19, 2017
5319121D3DE3159E0E472A848DB87D19F534A2May 5, 2017
52941928D9BA37747E8B010C50C13EEE49C6D9May 11, 2017
609026A04FA8F59C63FE724F6600F34C8CE0DCMay 15, 2017
362119E31C2D0C87FE5F9F919664E93BE447A5May 16, 2017
529725C5C1E448CA132D7554E7B959A3225C46May 19, 2017
561480C8A5F1B70066AD1E75187BF248149BA5Aug 19, 2017
5118970379D2A214319B1CB56C466C68BF96D3May 25, 2017
565399B0EA12C6C4C90826504D22CC13AD06FBJul 20, 2017
5132496696F9A464B7108C8B34C9BDE9F6F103Jun 2, 2017
559390DCF7BD6ABC70B1EB8677C278671B48CDJun 2, 2017
614952B7969D247A96C52BE36E9B469536FF9DJun 7, 2017
513200CF6825468BDC39DA26DE66106F5489B9Jul 28, 2017
5124466F450F72C705582E0E5E5E4D9A94306FJun 24, 2017
5129569C94FFD69712F30EFB13ADD4D788C92AJun 26, 2017
56363463182A295113351234A83D0AE7C54751Jun 27, 2017
7556524B3E8230D12EDAA3F00135DD3C660F2EAug 24, 2017
755055C68006DF51D29AAB507ABAF6FC94FBBCAug 14, 2017
5129606D37C92A8D9B4CC7B6EEA9CB45631E71Jul 22, 2017

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.

How to Remove helper-sig@savefrom.net.xpi^

  1. To enable deleting the helper-sig@savefrom.net.xpi file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select helper-sig@savefrom.net.xpi and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of helper-sig@savefrom.net.xpi and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of helper-sig@savefrom.net.xpi and Associated Malware.
  6. Notes:

    • The deletion of helper-sig@savefrom.net.xpi will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of helper-sig@savefrom.net.xpi will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a helper-sig@savefrom.net.xpi malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type helper-sig@savefrom.net.xpi. The name of the first found registry value referencing helper-sig@savefrom.net.xpi is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to helper-sig@savefrom.net.xpi, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of helper-sig@savefrom.net.xpi and Associated Malware.