ThreatExpert Report: Adware.Savenow, not-a-virus:WebToolbar.Win32.WhenU.a..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 5 January 2009, 15:39:11
Processing time: 8 min 36 sec
Submitted sample:

File MD5: 0x1C4722FBF0A55118C88130ED29E9012A
File SHA-1: 0x2CAAEEF73CFBEA06E443E65D670D591B71EE1E09
Filesize: 3,521,856 bytes
Alias & packer info:

Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
not-a-virus:AdTool.Win32.WhenU.a [Ikarus]
packed with: WiseSFXDropper [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\BearShare.lnk	700 bytes	MD5: 0x47C6BD9810F746653CA91C779F59C2A0 SHA-1: 0xAA57DE0BBB7745B38422BAC85D2B9F04E435E182	(not available)
2	%DesktopDir%\BearShare.lnk	694 bytes	MD5: 0xB9144DD89C2D752D94ED17BCB2F10EF0 SHA-1: 0xB9C77879BEFBA45286A4309BD7EF5C66716DA142	(not available)
3	%Temp%\VVSNInst.exe	106,560 bytes	MD5: 0x3E9C72F5B57307229D75FD5B8891593D SHA-1: 0xA7B7B6E51994D12E019783AADD6FF50F9A69946E	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdWare.Win32.SaveNow.bo [Ikarus]
4	%ProgramFiles%\BearShare\BearShare.dat	8,815 bytes	MD5: 0x541CCA9781AD792BD7C0828B3FB1ABFF SHA-1: 0xFCBC5D2A661F313BB45C83815637023A9309BE9E	(not available)
5	%ProgramFiles%\BearShare\BearShare.exe	3,223,552 bytes	MD5: 0x8FA9D3DF4AE74A4272F5F58BB3A0894F SHA-1: 0x66A0C3D00CE6F3EA7DE9BD30E196AAC60046752E	packed with Armadillo [Kaspersky Lab]
6	%ProgramFiles%\BearShare\BSidle.dll	24,576 bytes	MD5: 0x760911842FC80D9D54516BD5BA6931EF SHA-1: 0xA64410ECD2BAF150FD8D121707E0F910FCA6EAF9	(not available)
7	%ProgramFiles%\BearShare\db\connect.txt	108,501 bytes	MD5: 0x1CCA694A038B9D4904B2E8DD35F0B0C1 SHA-1: 0x41C2BA9512EBFF6DA5E69CDA44503DC78E00AA77	(not available)
8	%ProgramFiles%\BearShare\db\library.2.db	59,392 bytes	MD5: 0xEA2CE9224B453B1FD3929A5FEBE207F8 SHA-1: 0x2870EF48DAD9CB5D87A125F3FEE4C9AC8A1BC76B	(not available)
9	%ProgramFiles%\BearShare\db\library.2.db.lastgoodload.bak	59,392 bytes	MD5: 0xE64CBB986C370EEB9BC9604443F5B966 SHA-1: 0x6FFFB6B8DE7DB3DA9F3F0044D31C726ED0F5C7FB	(not available)
10	%ProgramFiles%\BearShare\db\library.db	59,392 bytes	MD5: 0x119A0DC96C5F53AC591991D500F637BE SHA-1: 0xCF880973694BE7E0C7F4B7258A857DF8D6A95D0E	(not available)
11	%ProgramFiles%\BearShare\db\library.db.lastgoodload.bak	59,392 bytes	MD5: 0xC22031B87B036BEBC2F9DD2E1F848A68 SHA-1: 0xA8DD70DF14F4362A9A5764D9C7AA77E2B7E85E5C	(not available)
12	%ProgramFiles%\BearShare\FreePeers.ini	46,819 bytes	MD5: 0xA093A4C893CEB41E252B3AA911E19CB7 SHA-1: 0x7BED3BDDE4DEE79884492028DBB205DD847644AD	(not available)
13	%ProgramFiles%\BearShare\History.txt	18,437 bytes	MD5: 0x203861BF7AF8DCE76A70F396E42F6BB5 SHA-1: 0x3A9E31C354D41D42A8AB6ED1528DF0CB53E25957	(not available)
14	%ProgramFiles%\BearShare\INSTALL.LOG	7,309 bytes	MD5: 0x5F07267E9431DAE0832E2D89B4587701 SHA-1: 0xA981047BFAE864579630D69DF131FDE0B18F0AD6	(not available)
15	%ProgramFiles%\BearShare\Logs\hosts-state.txt	13 bytes	MD5: 0x0729FCB0ABA010BE2C3B3E8042F650D2 SHA-1: 0x1097496C989149760A6A161BA642BEB6906BFA2B	(not available)
16	%ProgramFiles%\BearShare\Logs\memory.txt	11,960 bytes	MD5: 0x3BF0903ED5339F0465D9E18F5ED94CDC SHA-1: 0x6D48A6DDFFCF345F09012CD6830B25A0EA8E94FD	(not available)
17	%ProgramFiles%\BearShare\Logs\ordinal.txt	2,041 bytes	MD5: 0x9A3EDFA15234665793D3DBC5C6FCC794 SHA-1: 0x37D654CE7DF31E0D1869D9BDD0BB4C41649A8DEF	(not available)
18	%ProgramFiles%\BearShare\Logs\streams.txt	15 bytes	MD5: 0xE7364AB20091C0ECD7C12AB381C2CB28 SHA-1: 0xBDB2C67DA9440913D673C378E681A447E66205D8	(not available)
19	%ProgramFiles%\BearShare\RunMSC.dll	57,344 bytes	MD5: 0xB938EDABE9EFC9B024E79697E6C01FEA SHA-1: 0xFD5090E617EEA7AA80B99608828CE78F05A630A3	(not available)
20	%ProgramFiles%\BearShare\sounds\notify.wav	4,014 bytes	MD5: 0x4A61949290ADEBB4B096DE6655B24232 SHA-1: 0x4C8F681E6AD13FB800B3755F7B2025D18230DBB6	(not available)
21	%ProgramFiles%\BearShare\UNWISE.EXE	153,088 bytes	MD5: 0x973567B98CDFC147DF4E60471D9DF072 SHA-1: 0x3C4735750C99C63E6861170A8C459A608594211E	(not available)
22	%ProgramFiles%\BearShare\Webstats.bat	347 bytes	MD5: 0x3B1D35D193F6BA3F9E459530C3BFCD2B SHA-1: 0x6FA6866EB24F3D3AC1F5AF571A1716E85E140B0C	(not available)
23	%ProgramFiles%\BearShare\Webstats.exe	294,912 bytes	MD5: 0x3114E2732C4315B27F4BD31355DE547F SHA-1: 0x89AE915ABB094209909DB722CE641AFAE94767DB	(not available)
24	%ProgramFiles%\BearShare\Webstats.ini	3,159 bytes	MD5: 0x0C65B7A84781D5C016A04643D76A4F57 SHA-1: 0xD8624C2DE219C57F7E61DE84472FA1353DE37B60	(not available)
25	[file and pathname of the sample #1]	3,521,856 bytes	MD5: 0x1C4722FBF0A55118C88130ED29E9012A SHA-1: 0x2CAAEEF73CFBEA06E443E65D670D591B71EE1E09	Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] not-a-virus:AdTool.Win32.WhenU.a [Ikarus] packed with WiseSFXDropper [Kaspersky Lab]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\BearShare
%ProgramFiles%\VVSN
c:\My Downloads
%ProgramFiles%\BearShare\db
%ProgramFiles%\BearShare\Extras
%ProgramFiles%\BearShare\Installer
%ProgramFiles%\BearShare\Logs
%ProgramFiles%\BearShare\Playlists
%ProgramFiles%\BearShare\sounds
%ProgramFiles%\BearShare\Temp
%ProgramFiles%\BearShare\Webstats

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
BearShare.exe	%ProgramFiles%\bearshare\bearshare.exe	9,629,696 bytes
VVSNInst.exe	%Temp%\VVSNInst.exe	110,592 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	3,530,752 bytes
GLB1.tmp	%Temp%\GLB1.tmp	28,672 bytes
VVSN.exe	%ProgramFiles%\VVSN\VVSN.exe	122,880 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
BSidle.dll	%ProgramFiles%\BearShare\BSidle.dll	Process name: BearShare.exe Process filename: %ProgramFiles%\bearshare\bearshare.exe Address space: 0x1CD0000 - 0x1CD6000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type
HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current
HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32]

(Default) = "%System%\quartz.dll"
ThreadingModel = "Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}]

(Default) = "Color Space Converter"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID]

(Default) = "RunMSC.Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}]

(Default) = "ILoader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\BearShare\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0]

(Default) = "RunMSC 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu]

(Default) = "gnufile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k]

URL Protocol = ""
(Default) = "URL:ed2k Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu]

URL Protocol = ""
(Default) = "URL:GNU Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" "%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile]

(Default) = "gnutella"
BrowserFlags = 0x00000008
EditFlags = 0x00010000

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella]

URL Protocol = ""
(Default) = "URL:Gnutella Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet]

URL Protocol = ""
(Default) = "URL:Magnet Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}]

(Default) = "BearShare"
Version = "5,2,1,6"
ComponentID = "BearShare"
IsInstalled = 0x00000001
Locale = "EN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

BearShare = ""%ProgramFiles%\BearShare\BearShare.exe" /pause"

so that BearShare.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]

DisplayName = "BearShare"
UninstallString = "C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG"
DisplayVersion = "5.2.1.6"
HelpLink = "http://bearshare.com/help.htm"
Publisher = "Free Peers, Inc."
URLInfoAbout = "http://www.freepeers.com"
DisplayIcon = "%ProgramFiles%\BearShare\BearShare.exe,-128"

[HKEY_LOCAL_MACHINE\SOFTWARE\BearShare]

InstallDir = "%ProgramFiles%\BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B6 E7 98 78 FB 0D 1F FF FF FF FF 69 EB 67 03 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type]

urn:sha1 = 0x00000000
urn:bitprint = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare]

(Default) = "Bearshare"
Description = "Bearshare can automatically search for and download the selected content on its peer-to-peer network."
DefaultIcon = ""%ProgramFiles%\BearShare\BearShare.exe",-130"
ShellExecute = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"
DdeApplication = "BearShare"
DdeTopic = "URLHandler"

[HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

[HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

Other details

To mark the presence in the system, the following Mutex objects were created:

DBWinMutex
RAL1A8B7953
1A8B7953::WK
FreePeers_BearShare
c:
WhenU_VVSN_1_0_SharedMutex

The following ports were open in the system:

Port	Protocol	Process
1025	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1026	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1027	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1028	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1029	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1030	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1031	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1033	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1034	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1035	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1036	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1037	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1038	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1039	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1040	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1041	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1042	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1043	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1044	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1046	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1047	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1048	TCP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1048	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1049	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1050	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1051	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1052	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1053	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1054	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1055	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1056	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1057	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1058	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1059	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1060	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1061	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1062	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1063	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1064	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1065	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1066	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1067	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1068	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1069	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1070	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1071	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1072	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1073	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1074	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1075	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1076	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1077	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1078	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1079	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1080	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1081	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1082	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1083	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1084	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1085	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1086	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1087	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1088	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1089	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1090	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1091	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1092	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1093	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1094	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1095	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1096	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1097	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1098	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1099	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1100	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1101	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1102	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1103	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1104	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1105	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1106	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1107	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1108	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1109	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1110	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1111	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1112	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1113	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1114	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1115	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1116	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1117	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1118	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1119	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1120	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1121	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1122	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1123	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1124	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1125	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)

The following Host Names were requested from a host database:

24.165.49.128
privateport1.bearshare.net
gwc1.mager.org
g2cache.theg2.net
private1.bearshare.net
cache.mynapster.com
www.easwww.xolox.nl

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
66.253.211.9	6346
84.10.167.13	6346
208.22.15.254	6346
67.190.191.221	6346
211.30.108.15	6346
65.49.143.74	6346
24.33.31.145	6346
69.92.39.115	6346
213.101.249.94	6346
84.190.235.134	6346
68.185.212.50	6348
80.219.50.185	6348
24.179.134.150	6348
84.28.234.193	6348
80.185.115.63	6348
206.116.183.207	6348
200.43.26.39	6348
69.241.209.67	6348
64.228.66.133	6348
85.178.208.144	6348
62.235.140.223	9119
www.easwww.xolox.nl	1033

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
www.bearshare.com	80	(null)	(null)
app.whenu.com	80	(null)	(null)
spweb.whenu.com	80	(null)	(null)

The following GET requests were made:

AppInstall?app=VVSN&url=EEPE120501&id=9C10EF3AF0AB42969AC3FDED464493A9&ui=JH
vvsn/EEPE120501/vsn.cfg
AppInstall?app=VVSN_CFG&url=EEPE120501&id=9C10EF3AF0AB42969AC3FDED464493A9&ui=QF

The following HTTP URLs were started reading:

http://g2cache.theg2.net/gwcache/lynnx.asp?client=BEAR&version=5.2.1.6&hostfile=1
http://cache.mynapster.com/?client=BEAR&version=5.2.1.6&hostfile=1
http://www.easwww.xolox.nl/gwebcache/default.asp?client=BEAR&version=5.2.1.6&hostfile=1
http://www.whenudownloads.com/vvsn/prod/SAVEInst.exe

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 6346:

There was an outbound traffic produced on port 6348:

There was an outbound traffic produced on port 9119:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 312E 360D 0A41 6363 6570 742D 456E 636F | 1.6..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2036 322E 3233 352E 3134 302E 3232 | P: 62.235.140.22
00000100 | 330D 0A47 4745 503A 2030 2E35 0D0A 582D | 3..GGEP: 0.5..X-
00000110 | 4465 6772 6565 3A20 3236 0D0A 582D 556C | Degree: 26..X-Ul
00000120 | 7472 6170 6565 722D 5175 6572 792D 526F | trapeer-Query-Ro
00000130 | 7574 696E 673A 2030 2E31 0D0A 582D 4D61 | uting: 0.1..X-Ma
00000140 | 782D 5454 4C3A 2034 0D0A 582D 4479 6E61 | x-TTL: 4..X-Dyna
00000150 | 6D69 632D 5175 6572 7969 6E67 3A20 302E | mic-Querying: 0.
00000160 | 310D 0A58 2D50 726F 6265 2D51 7565 7269 | 1..X-Probe-Queri
00000170 | 6573 3A20 302E 310D 0A46 502D 3161 3A20 | es: 0.1..FP-1a:
00000180 | 3132 382C AEBF C136 A0A3 ABBE 2B8E 432F | 128,...6....+.C/
00000190 | 5989 7B66 D994 624C FA93 83E9 C4CF DD4F | Y.{f..bL.......O
000001A0 | F038 6D69 2436 0D0A 4650 2D41 7574 682D | .8mi$6..FP-Auth-
000001B0 | 4368 616C 6C65 6E67 653A 2037 5833 584B | Challenge: 7X3XK
000001C0 | 5737 4441 594B 4336 4D45 525A 3456 4853 | W7DAYKC6MERZ4VHS
000001D0 | 4C44 4C56 5644 4A58 5642 460D 0A0D 0A   | LDLVVDJXVBF....

There was an outbound traffic produced on port 6000:

There was an outbound traffic produced on port 1024:

There was an outbound traffic produced on port 9411:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 312E 360D 0A41 6363 6570 742D 456E 636F | 1.6..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2036 352E 3137 352E 3139 382E 3734 | P: 65.175.198.74
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2C3B DE70 4831 7BE5 9DF3 4398 782F | 28,;.pH1{...C.x/
00000190 | 3221 53A6 A365 6B5F FC6A C1B7 60FE 7AEB | 2!S..ek_.j..`.z.
000001A0 | E7E0 D821 8F0D 0A46 502D 4175 7468 2D43 | ...!...FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 3646 4942 3543 | hallenge: 6FIB5C
000001C0 | 4543 3458 3558 354F 3658 584A 4936 5248 | EC4X5X5O6XXJI6RH
000001D0 | 4B54 5644 3449 5856 4432 0D0A 0D0A      | KTVD4IXVD2....

There was an outbound traffic produced on port 7100:

There was an outbound traffic produced on port 8271:

There was an outbound traffic produced on port 39587:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 312E 360D 0A41 6363 6570 742D 456E 636F | 1.6..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2036 392E 3235 302E 3133 352E 3139 | P: 69.250.135.19
00000100 | 370D 0A47 4745 503A 2030 2E35 0D0A 582D | 7..GGEP: 0.5..X-
00000110 | 4465 6772 6565 3A20 3236 0D0A 582D 556C | Degree: 26..X-Ul
00000120 | 7472 6170 6565 722D 5175 6572 792D 526F | trapeer-Query-Ro
00000130 | 7574 696E 673A 2030 2E31 0D0A 582D 4D61 | uting: 0.1..X-Ma
00000140 | 782D 5454 4C3A 2034 0D0A 582D 4479 6E61 | x-TTL: 4..X-Dyna
00000150 | 6D69 632D 5175 6572 7969 6E67 3A20 302E | mic-Querying: 0.
00000160 | 310D 0A58 2D50 726F 6265 2D51 7565 7269 | 1..X-Probe-Queri
00000170 | 6573 3A20 302E 310D 0A46 502D 3161 3A20 | es: 0.1..FP-1a:
00000180 | 3132 382C DF8A B19B 5C75 B8B4 C4DD 697D | 128,....\u....i}
00000190 | 48B1 7C79 C1BE 93AD 2189 FA65 43D1 BFC2 | H.|y....!..eC...
000001A0 | DB88 8258 21FB 0D0A 4650 2D41 7574 682D | ...X!...FP-Auth-
000001B0 | 4368 616C 6C65 6E67 653A 204D 5A4C 4951 | Challenge: MZLIQ
000001C0 | 3447 4248 3257 5944 4B43 5547 4F4C 3444 | 4GBH2WYDKCUGOL4D
000001D0 | 3350 3756 5746 3656 4C48 520D 0A0D 0A   | 3P7VWF6VLHR....

There was an outbound traffic produced on port 6544:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 312E 360D 0A41 6363 6570 742D 456E 636F | 1.6..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2036 392E 3137 312E 3133 362E 3433 | P: 69.171.136.43
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2CDD 3ED8 E49D 8C31 6EF9 8983 CADC | 28,.>....1n.....
00000190 | 5ED3 ADEE 3B46 C760 7666 25B9 AFA7 7D63 | ^...;F.`vf%...}c
000001A0 | FF4B F421 430D 0A46 502D 4175 7468 2D43 | .K.!C..FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 524F 484D 5A32 | hallenge: ROHMZ2
000001C0 | 4C4E 4449 4E53 3548 5536 4A32 4A59 3451 | LNDINS5HU6J2JY4Q
000001D0 | 4C51 5948 4852 4455 474F 0D0A 0D0A      | LQYHHRDUGO....

Downloaded File Summary:

Download details:

Download retrieved: 5 January 2009 15:48:06
Processing time: 6 min 42 sec
Downloaded sample:

File MD5: 0x57CD9489DA9FEF8A95B037F444A405C5
File SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA
Filesize: 849,784 bytes
Alias:

Adware.WhenU.AQ [PCTools]
Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
Adware-SaveNow [McAfee]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.VB	Adware.VB is a generic detection for adware programs compiled in Visual Basic. It displays popup advertisements and may download other adware and spyware without the users knowledge.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WhenU\Customer Support.lnk	1,496 bytes	MD5: 0x4A15990F81E98132089F6F54D2416443 SHA-1: 0xF61B8E8FE28295E56642C7923C07DA375C2E9D14	(not available)
2	%Programs%\WhenU\Learn More About WhenU Save.url	94 bytes	MD5: 0x0159B6EBE18CA4F7E4B388D9618E3E38 SHA-1: 0x7435552810F8576C0F02AF38F0083C0B50E3AC31	(not available)
3	%Programs%\WhenU\Learn More About WhenU SaveNow.url	97 bytes	MD5: 0xECE8558E98F0FCDB6E3ED83E77A88B06 SHA-1: 0xB04B01CABA33CFCFFF84281941C7669B7B308053	(not available)
4	%Programs%\WhenU\Uninstall Instructions.lnk	1,496 bytes	MD5: 0xBD5864B3A3A2879600834FB915A63873 SHA-1: 0x99B2221C320706635A8D142CA676E01B1F16EA08	(not available)
5	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0x4F55DC3B774E94604DA1E29A73DDA2ED SHA-1: 0xD719AB3B2E3606F2B05A4398BFB50ADD7E40DA24	(not available)
6	%ProgramFiles%\Save\ACM.dll	516,472 bytes	MD5: 0xAD616A7E4A5306582E0F7363E36E0E75 SHA-1: 0x33C78E3161F1D59AA14005D058844138B6B71913	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
7	%ProgramFiles%\Save\ffext.mod	12,814 bytes	MD5: 0x501D4C0B7D3C5449210007EC658C47ED SHA-1: 0x1201DB4A4DABEA7DFDE53AC2107CD00074274167	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.z [Kaspersky Lab] AdWare.Win32.WhenU [Ikarus]
8	%ProgramFiles%\Save\Save.exe	803,184 bytes	MD5: 0x47754BF98FD5A4BC05C3B08221D6426A SHA-1: 0xC533F42FCA267458C489077B8DDC12F1A64526FD	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
9	%ProgramFiles%\Save\save.htm	135,229 bytes	MD5: 0x64A8BEC37176AC27F4F5781139C9D744 SHA-1: 0xE01493BB480EDDE0D563D9F9C76886BC8D9EE186	HTML.Pestblock [Ikarus]
10	%ProgramFiles%\Save\SaveUninst.exe	118,200 bytes	MD5: 0x7AADCB4EB4B8EBDA8BE77548754427DA SHA-1: 0xC5610CD5AC119E395E843FE1C0893ACD1141EBE1	Adware.Savenow [Symantec] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] Virus.Win32.Trojan [Ikarus]
11	[file and pathname of the sample #1]	849,784 bytes	MD5: 0x57CD9489DA9FEF8A95B037F444A405C5 SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA	Adware.WhenU.AQ [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WhenU
%ProgramFiles%\Save

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\Save\Save.exe	827,392 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	860,160 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL]

AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}]

(Default) = "ACM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID]

(Default) = "ACM.ACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32]

(Default) = "%ProgramFiles%\Save\ACM.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}]

(Default) = "ACMFactory Class"
AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}]

(Default) = "IFetchExtractor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}]

(Default) = "IACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}]

(Default) = "IFetchData"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32]

(Default) = "%ProgramFiles%\Save\ACM.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Save\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0]

(Default) = "ACM 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002700877"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akdwl.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "4.22"
timedDBUpdate_rs = "Y"
SystemParam_rs = "dt=WhenU Save;q=;i=1"
uninst_rs = "4.2202"
extra_url = "http://www.whenudownloads.com/extra.exe"
extraver_url = "http://www.whenudownloads.com/extraver.html"
ziptomsa_url = "http://akapp.whenu.com/ziptomsa"
InstallTime = "20081019184426"
LastPartner = ""
SetupCmdLine = "http://web.whenu.com/Offers?iou=i&clp=&pip=0"
zip = ""
acm_rs = "1.05"
TotalPartner = "0"
newuser_rs = "Y"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

WhenU_WhenUSave_SharedMutex

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
offers.whenu.com	80	(null)	(null)

The following GET requests were made:

installed.html?app=whenusave&ptr=&pds=&toi=20081019184426
index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.