ThreatExpert Report: Adware.WhenU_SaveNow, not-a-virus:AdTool.Win32.WhenU.i..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 5 February 2008, 17:40:38
Processing time: 3 min 15 sec
Submitted sample:

File MD5: 0x10F9C395BF459897D24A92F8BC1712E5
Filesize: 847,736 bytes
Alias:

Adware.WhenU_SaveNow [PCTools]
not-a-virus:AdTool.Win32.WhenU.i, not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab]
Adware-SaveNow [McAfee]

Summary of the findings:

What's been found	Severity Level
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU!sd5	Adware.WhenU!sd5 is a potentially unwanted adware component.
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WhenU\Customer Support.lnk	1,496 bytes	MD5: 0x6E3801E33D6A56DC24EC05A529335FB2	(not available)
2	%Programs%\WhenU\Learn More About WhenU Save.url	94 bytes	MD5: 0x7F428388688CC5D6BC226E8A425FF8E5	(not available)
3	%Programs%\WhenU\Learn More About WhenU SaveNow.url	97 bytes	MD5: 0x0BD85A0C1C5B29B748E0D64B892252F8	(not available)
4	%Programs%\WhenU\Uninstall Instructions.lnk	1,496 bytes	MD5: 0xEAAB73D33A20701B545AA1E6B7533E6B	(not available)
5	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0x3F6601259705B750720A9611FF27302A	(not available)
6	%ProgramFiles%\Save\ACM.dll	516,472 bytes	MD5: 0xAD616A7E4A5306582E0F7363E36E0E75	Adware.WhenU!sd5 [PCTools] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee]
7	%ProgramFiles%\Save\ffext.mod	12,814 bytes	MD5: 0x501D4C0B7D3C5449210007EC658C47ED	(not available)
8	%ProgramFiles%\Save\Save.exe	803,184 bytes	MD5: 0x47754BF98FD5A4BC05C3B08221D6426A	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee]
9	%ProgramFiles%\Save\save.htm	132,849 bytes	MD5: 0xE1832A5ED17D573FEF3C77050F5C7D18	HTML_SAVENOW.CC [Trend Micro]
10	%ProgramFiles%\Save\SaveUninst.exe	118,200 bytes	MD5: 0x6B22AAE434B9E0395749C2C037D7EB80	(not available)
11	[file and pathname of the sample #1]	847,736 bytes	MD5: 0x10F9C395BF459897D24A92F8BC1712E5	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdTool.Win32.WhenU.i, not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WhenU
%ProgramFiles%\Save

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\Save\Save.exe	827,392 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	860,160 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL]

AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}]

(Default) = "ACM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID]

(Default) = "ACM.ACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32]

(Default) = "%ProgramFiles%\Save\ACM.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}]

(Default) = "ACMFactory Class"
AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}]

(Default) = "IFetchExtractor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}]

(Default) = "IACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}]

(Default) = "IFetchData"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32]

(Default) = "%ProgramFiles%\Save\ACM.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Save\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0]

(Default) = "ACM 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002700870"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akdwl.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "4.22"
timedDBUpdate_rs = "Y"
SystemParam_rs = "dt=WhenU Save;q=;i=1"
uninst_rs = "4.2202"
extra_url = "http://www.whenudownloads.com/extra.exe"
extraver_url = "http://www.whenudownloads.com/extraver.html"
ziptomsa_url = "http://akapp.whenu.com/ziptomsa"
InstallTime = "20080107151459"
LastPartner = ""
SetupCmdLine = "http://web.whenu.com/clientupdate?iou=u&pip=0"
zip = ""
UpdateTime = "20080107151459"
acm_rs = "1.05"
TotalPartner = "0"
newuser_rs = "Y"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

WhenU_WhenUSave_SharedMutex

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.