ThreatExpert Report: Adware.SaveNow!sd5, not-a-virus:WebToolbar.Win32.WhenU.a..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 5 January 2009, 13:57:37
Processing time: 9 min 23 sec
Submitted sample:

File MD5: 0x6F356DCB1C7B7839E6C1E134B6342B2B
File SHA-1: 0xF01F35CC698D295EC539D12E5CBF8FFB628C07D2
Filesize: 3,472,704 bytes
Alias & packer info:

Adware.SaveNow!sd5 [PCTools]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
not-a-virus:AdWare.Win32.SaveNow.z [Ikarus]
packed with: WiseSFXDropper [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.SaveNow!sd5	Adware.SaveNow!sd5 is a potentially unwanted adware program that could be used to display various pop-up advertisements.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\BearShare.lnk	700 bytes	MD5: 0x956BEC3D73B831DBF6EC5633E9892BD6 SHA-1: 0x7F2ECCE8F7DF1E8203E9076A72B850705ABC69BC	(not available)
2	%DesktopDir%\BearShare Downloads.lnk	1,273 bytes	MD5: 0xFE96760F86FEFF77567F6834F471A40B SHA-1: 0x422F399737F394DD1C63A10EF563CDE2E9576E13	(not available)
3	%DesktopDir%\BearShare.lnk	694 bytes	MD5: 0x5A2884A0FD8E592B94C0F8077841FB53 SHA-1: 0xEB75F428F45EDBEA4E0C7B15861AEC3B3CC082C5	(not available)
4	%Temp%\VVSNInst.exe	106,560 bytes	MD5: 0x3E9C72F5B57307229D75FD5B8891593D SHA-1: 0xA7B7B6E51994D12E019783AADD6FF50F9A69946E	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdWare.Win32.SaveNow.bo [Ikarus]
5	%ProgramFiles%\BearShare\BearShare.exe	3,039,232 bytes	MD5: 0x5B56DC79C07B4A82E5BC8AB1170250AB SHA-1: 0xBB26BA69646031289B91AF33A02BB0FB833A8F78	packed with Armadillo [Kaspersky Lab]
6	%ProgramFiles%\BearShare\BSidle.dll	24,576 bytes	MD5: 0x760911842FC80D9D54516BD5BA6931EF SHA-1: 0xA64410ECD2BAF150FD8D121707E0F910FCA6EAF9	(not available)
7	%ProgramFiles%\BearShare\db\connect.txt	169,763 bytes	MD5: 0xF00C2A54E83FD85A35A1E10E9C744EE1 SHA-1: 0x3D13E3BB1E15879D16E4CD0735472C9F34C873CE	(not available)
8	%ProgramFiles%\BearShare\db\gnucache.dat	16,463 bytes	MD5: 0x594722E9EBB5E8EFA02F96DD4CEE1684 SHA-1: 0x2D69B9D3F525BBEA0700C0943CA123955B2C2A11	(not available)
9	%ProgramFiles%\BearShare\db\hbcache.dat	16,342 bytes	MD5: 0x1319987BFDC711F1FB75307D6C1F7F3D SHA-1: 0xE345FB464E2B65B27AE69D4C3E7D07881820928A	(not available)
10	%ProgramFiles%\BearShare\History.txt	56,090 bytes	MD5: 0x09ED19097349BA07F95F2F6B23FD9263 SHA-1: 0x64F8895B1736B48F678939EF4E71B96EDD5B398F	(not available)
11	%ProgramFiles%\BearShare\INSTALL.LOG	7,790 bytes	MD5: 0x2FBE1335C9F112F7EA39878D123962E1 SHA-1: 0x9D4F421C6BED1CC6CF924DE76F518F21155B74DA	(not available)
12	%ProgramFiles%\BearShare\Installer\saveinstwm.exe	106,568 bytes	MD5: 0xD40CBE5879F61D58988BE9C5956B245D SHA-1: 0x65492BBA5DB8D29B5D747BD6E140F24543AF3508	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:AdWare.Win32.SaveNow.z [Kaspersky Lab] Generic.dx [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdWare.Win32.SaveNow.z [Ikarus]
13	%ProgramFiles%\BearShare\RunMSC.dll	57,344 bytes	MD5: 0xB938EDABE9EFC9B024E79697E6C01FEA SHA-1: 0xFD5090E617EEA7AA80B99608828CE78F05A630A3	(not available)
14	%ProgramFiles%\BearShare\sounds\notify.wav	4,014 bytes	MD5: 0x4A61949290ADEBB4B096DE6655B24232 SHA-1: 0x4C8F681E6AD13FB800B3755F7B2025D18230DBB6	(not available)
15	%ProgramFiles%\BearShare\UNWISE.EXE	153,088 bytes	MD5: 0x973567B98CDFC147DF4E60471D9DF072 SHA-1: 0x3C4735750C99C63E6861170A8C459A608594211E	(not available)
16	%ProgramFiles%\BearShare\Webstats.bat	347 bytes	MD5: 0x3B1D35D193F6BA3F9E459530C3BFCD2B SHA-1: 0x6FA6866EB24F3D3AC1F5AF571A1716E85E140B0C	(not available)
17	%ProgramFiles%\BearShare\Webstats.exe	294,912 bytes	MD5: 0x3114E2732C4315B27F4BD31355DE547F SHA-1: 0x89AE915ABB094209909DB722CE641AFAE94767DB	(not available)
18	%ProgramFiles%\BearShare\Webstats.ini	3,159 bytes	MD5: 0x0C65B7A84781D5C016A04643D76A4F57 SHA-1: 0xD8624C2DE219C57F7E61DE84472FA1353DE37B60	(not available)
19	[file and pathname of the sample #1]	3,472,704 bytes	MD5: 0x6F356DCB1C7B7839E6C1E134B6342B2B SHA-1: 0xF01F35CC698D295EC539D12E5CBF8FFB628C07D2	Adware.SaveNow!sd5 [PCTools] not-a-virus:AdWare.Win32.SaveNow.z, not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] not-a-virus:AdWare.Win32.SaveNow.z [Ikarus] packed with WiseSFXDropper [Kaspersky Lab]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\BearShare
%ProgramFiles%\VVSN
c:\My Downloads
%ProgramFiles%\BearShare\db
%ProgramFiles%\BearShare\Extras
%ProgramFiles%\BearShare\Installer
%ProgramFiles%\BearShare\Playlists
%ProgramFiles%\BearShare\sounds
%ProgramFiles%\BearShare\Temp
%ProgramFiles%\BearShare\Webstats

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
BearShare.exe	%ProgramFiles%\bearshare\bearshare.exe	9,351,168 bytes
VVSN.exe	%ProgramFiles%\VVSN\VVSN.exe	122,880 bytes
VVSNInst.exe	%Temp%\VVSNInst.exe	110,592 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	3,481,600 bytes
GLB1.tmp	%Temp%\GLB1.tmp	28,672 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
BSidle.dll	%ProgramFiles%\BearShare\BSidle.dll	Process name: BearShare.exe Process filename: %ProgramFiles%\bearshare\bearshare.exe Address space: 0x1C60000 - 0x1C66000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current
HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\ProgID]

(Default) = "script"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InprocServer32]

(Default) = "%System%\scrobj.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}]

(Default) = "Moniker to a Windows Script Component"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID]

(Default) = "RunMSC.Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}]

(Default) = "ILoader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\BearShare\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0]

(Default) = "RunMSC 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu]

(Default) = "gnufile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k]

URL Protocol = ""
(Default) = "URL:ED2K Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu]

URL Protocol = ""
(Default) = "URL:GNU Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" "%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile]

(Default) = "gnutella"
BrowserFlags = 0x00000008
EditFlags = 0x00010000

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella]

URL Protocol = ""
(Default) = "URL:Gnutella Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet]

URL Protocol = ""
(Default) = "URL:Magnet Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}]

(Default) = "BearShare"
Version = "4,7,3,4"
ComponentID = "BearShare"
IsInstalled = 0x00000001
Locale = "EN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]

DisplayName = "BearShare"
UninstallString = "C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG"
DisplayVersion = "4.7.3.4"
HelpLink = "http://bearshare.com/help.htm"
Publisher = "Free Peers, Inc."
URLInfoAbout = "http://www.freepeers.com"
DisplayIcon = "%ProgramFiles%\BearShare\BearShare.exe,-128"

[HKEY_LOCAL_MACHINE\SOFTWARE\BearShare]

InstallDir = "%ProgramFiles%\BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B6 E7 98 78 FB 0D 1F FF FF FF FF 69 EB 67 03 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F
{I56B3CF0D9AB991E1} = 02 00 00 00

[HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

[HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

Other details

To mark the presence in the system, the following Mutex objects were created:

WhenU_VVSN_1_0_SharedMutex
RAL1A8B7953
FreePeers_BearShare
c:

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
app.whenu.com	80	(null)	(null)
spweb.whenu.com	80	(null)	(null)

The following GET requests were made:

AppInstall?app=VVSN&url=EEPE010501&id=3F92E87BAF9249D9B99C147667CE50A2&ui=JH
vvsn/EEPE010501/vsn.cfg
AppInstall?app=VVSN_CFG&url=EEPE010501&id=3F92E87BAF9249D9B99C147667CE50A2&ui=QF

The following HTTP URL was started reading:

http://www.whenudownloads.com/vvsn/prod/SAVEInst.exe

Downloaded File Summary:

Download details:

Download retrieved: 5 January 2009 14:07:16
Processing time: 7 min 20 sec
Downloaded sample:

File MD5: 0x57CD9489DA9FEF8A95B037F444A405C5
File SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA
Filesize: 849,784 bytes
Alias:

Adware.WhenU.AQ [PCTools]
Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
Adware-SaveNow [McAfee]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.VB	Adware.VB is a generic detection for adware programs compiled in Visual Basic. It displays popup advertisements and may download other adware and spyware without the users knowledge.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WhenU\Customer Support.lnk	1,496 bytes	MD5: 0x1D976994C2C4526A4D248E2BFE15AFEE SHA-1: 0x8BFE06F6EED6E6453AE69F379CBE9414CD0586CA	(not available)
2	%Programs%\WhenU\Learn More About WhenU Save.url	94 bytes	MD5: 0xDE5BA385BD22A04085808BF72F2C61BB SHA-1: 0x9ADE7233DFB20FA25DFCB8578A5A4598B0631CD8	(not available)
3	%Programs%\WhenU\Learn More About WhenU SaveNow.url	97 bytes	MD5: 0xA030C3CCC5EE84292DC8CCE69EE1CA30 SHA-1: 0xB725A5D65E1CE118D40B3B5350E32DA472623F6E	(not available)
4	%Programs%\WhenU\Uninstall Instructions.lnk	1,496 bytes	MD5: 0x528DC3059E70A17828FF0E8E73E5D508 SHA-1: 0xC051F8EAAA93963883C091FFA87DA529BFA96B50	(not available)
5	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0x05D44C84BCC2693779B896C08BDCF980 SHA-1: 0x8E3130DBC9000A769D47406ADCB7182383505F84	(not available)
6	%ProgramFiles%\Save\ACM.dll	516,472 bytes	MD5: 0xAD616A7E4A5306582E0F7363E36E0E75 SHA-1: 0x33C78E3161F1D59AA14005D058844138B6B71913	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
7	%ProgramFiles%\Save\ffext.mod	12,814 bytes	MD5: 0x501D4C0B7D3C5449210007EC658C47ED SHA-1: 0x1201DB4A4DABEA7DFDE53AC2107CD00074274167	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.z [Kaspersky Lab] AdWare.Win32.WhenU [Ikarus]
8	%ProgramFiles%\Save\Save.exe	803,184 bytes	MD5: 0x47754BF98FD5A4BC05C3B08221D6426A SHA-1: 0xC533F42FCA267458C489077B8DDC12F1A64526FD	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
9	%ProgramFiles%\Save\save.htm	135,229 bytes	MD5: 0x64A8BEC37176AC27F4F5781139C9D744 SHA-1: 0xE01493BB480EDDE0D563D9F9C76886BC8D9EE186	HTML.Pestblock [Ikarus]
10	%ProgramFiles%\Save\SaveUninst.exe	118,200 bytes	MD5: 0x7AADCB4EB4B8EBDA8BE77548754427DA SHA-1: 0xC5610CD5AC119E395E843FE1C0893ACD1141EBE1	Adware.Savenow [Symantec] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] Virus.Win32.Trojan [Ikarus]
11	[file and pathname of the sample #1]	849,784 bytes	MD5: 0x57CD9489DA9FEF8A95B037F444A405C5 SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA	Adware.WhenU.AQ [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WhenU
%ProgramFiles%\Save

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\Save\Save.exe	827,392 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	860,160 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL]

AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}]

(Default) = "ACM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID]

(Default) = "ACM.ACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32]

(Default) = "%ProgramFiles%\Save\ACM.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}]

(Default) = "ACMFactory Class"
AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}]

(Default) = "IFetchExtractor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}]

(Default) = "IACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}]

(Default) = "IFetchData"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32]

(Default) = "%ProgramFiles%\Save\ACM.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Save\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0]

(Default) = "ACM 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002700877"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akdwl.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "4.22"
timedDBUpdate_rs = "Y"
SystemParam_rs = "dt=WhenU Save;q=;i=1"
uninst_rs = "4.2202"
extra_url = "http://www.whenudownloads.com/extra.exe"
extraver_url = "http://www.whenudownloads.com/extraver.html"
ziptomsa_url = "http://akapp.whenu.com/ziptomsa"
InstallTime = "20081019184429"
LastPartner = ""
SetupCmdLine = "http://web.whenu.com/Offers?iou=i&clp=&pip=0"
zip = ""
acm_rs = "1.05"
TotalPartner = "0"
newuser_rs = "Y"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

WhenU_WhenUSave_SharedMutex

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
offers.whenu.com	80	(null)	(null)

The following GET requests were made:

installed.html?app=whenusave&ptr=&pds=&toi=20081019184429
index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.