ThreatExpert Report: not-a-virus:WebToolbar.Win32.WhenU.a, AdWare.Win32.WhenU, Adware.WhenU

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 6 January 2009, 15:38:16
Processing time: 9 min 13 sec
Submitted sample:

File MD5: 0x8524546A4EA530AF4ABA3081C2BED9BF
File SHA-1: 0x9E2FFDDE17A279B6EA58DCA18C174E20873B098A
Filesize: 3,521,856 bytes
Alias & packer info:

not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
AdWare.Win32.WhenU [Ikarus]
packed with: WiseSFXDropper [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%CommonPrograms%\BearShare.lnk	700 bytes	MD5: 0x5EC9743E41CCA6D68D311025A9674277 SHA-1: 0x9AB64EA90B7712CF6D45B2EEE354D7B73F75B80B	(not available)
2	%DesktopDir%\BearShare.lnk	694 bytes	MD5: 0x144E32D5ECD7FCB09533AF55041EB2A3 SHA-1: 0x0A385334F7AF9123813E3E04FEAE0B135186776A	(not available)
3	%Temp%\VVSNInst.exe	106,560 bytes	MD5: 0x3E9C72F5B57307229D75FD5B8891593D SHA-1: 0xA7B7B6E51994D12E019783AADD6FF50F9A69946E	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdWare.Win32.SaveNow.bo [Ikarus]
4	%ProgramFiles%\BearShare\BearShare.dat	8,815 bytes	MD5: 0x541CCA9781AD792BD7C0828B3FB1ABFF SHA-1: 0xFCBC5D2A661F313BB45C83815637023A9309BE9E	(not available)
5	%ProgramFiles%\BearShare\BearShare.exe	3,223,552 bytes	MD5: 0xBA693B48B85927C6F35BEB239705DE7C SHA-1: 0x47967CB4AE504132B33621DA3887A7C9AB7A1ED5	packed with Armadillo [Kaspersky Lab]
6	%ProgramFiles%\BearShare\BSidle.dll	24,576 bytes	MD5: 0x760911842FC80D9D54516BD5BA6931EF SHA-1: 0xA64410ECD2BAF150FD8D121707E0F910FCA6EAF9	(not available)
7	%ProgramFiles%\BearShare\db\connect.txt	108,501 bytes	MD5: 0x1CCA694A038B9D4904B2E8DD35F0B0C1 SHA-1: 0x41C2BA9512EBFF6DA5E69CDA44503DC78E00AA77	(not available)
8	%ProgramFiles%\BearShare\db\library.2.db %ProgramFiles%\BearShare\db\library.2.db.lastgoodload.bak	59,392 bytes	MD5: 0x733D8BBAE3D53D34164F5EE9A2609121 SHA-1: 0xF579F76FEC6045891B0C33B48A956F65CB27D5D3	(not available)
9	%ProgramFiles%\BearShare\db\library.db %ProgramFiles%\BearShare\db\library.db.lastgoodload.bak	59,392 bytes	MD5: 0xE64CBB986C370EEB9BC9604443F5B966 SHA-1: 0x6FFFB6B8DE7DB3DA9F3F0044D31C726ED0F5C7FB	(not available)
10	%ProgramFiles%\BearShare\FreePeers.ini	46,819 bytes	MD5: 0xAE2E1DA3879545B75590646455EA67B7 SHA-1: 0x36DD6EA52CAD4F271D1C24FC7B500FEDB7D8A780	(not available)
11	%ProgramFiles%\BearShare\History.txt	17,168 bytes	MD5: 0xE6E9117D704AEDD38C823FB05FBA97B8 SHA-1: 0x6F1FE23B1991FF70E5B1C26F1FEA15DCB53D3B65	(not available)
12	%ProgramFiles%\BearShare\INSTALL.LOG	7,309 bytes	MD5: 0x80CB67DC54FFF2A3B571570B185FDD2F SHA-1: 0x6F861B8882BF22BBCBBC3690E232C6431B7291C1	(not available)
13	%ProgramFiles%\BearShare\Logs\hosts-state.txt	13 bytes	MD5: 0x0729FCB0ABA010BE2C3B3E8042F650D2 SHA-1: 0x1097496C989149760A6A161BA642BEB6906BFA2B	(not available)
14	%ProgramFiles%\BearShare\Logs\memory.txt	11,960 bytes	MD5: 0x230101C505C45C157DA32F8674F14A69 SHA-1: 0xE732432B4D06BFAFEDAD21425EAFA35CE2F62757	(not available)
15	%ProgramFiles%\BearShare\Logs\ordinal.txt	2,041 bytes	MD5: 0x9A3EDFA15234665793D3DBC5C6FCC794 SHA-1: 0x37D654CE7DF31E0D1869D9BDD0BB4C41649A8DEF	(not available)
16	%ProgramFiles%\BearShare\Logs\streams.txt	15 bytes	MD5: 0xE7364AB20091C0ECD7C12AB381C2CB28 SHA-1: 0xBDB2C67DA9440913D673C378E681A447E66205D8	(not available)
17	%ProgramFiles%\BearShare\RunMSC.dll	57,344 bytes	MD5: 0xB938EDABE9EFC9B024E79697E6C01FEA SHA-1: 0xFD5090E617EEA7AA80B99608828CE78F05A630A3	(not available)
18	%ProgramFiles%\BearShare\sounds\notify.wav	4,014 bytes	MD5: 0x4A61949290ADEBB4B096DE6655B24232 SHA-1: 0x4C8F681E6AD13FB800B3755F7B2025D18230DBB6	(not available)
19	%ProgramFiles%\BearShare\UNWISE.EXE	153,088 bytes	MD5: 0x973567B98CDFC147DF4E60471D9DF072 SHA-1: 0x3C4735750C99C63E6861170A8C459A608594211E	(not available)
20	%ProgramFiles%\BearShare\Webstats.bat	347 bytes	MD5: 0x3B1D35D193F6BA3F9E459530C3BFCD2B SHA-1: 0x6FA6866EB24F3D3AC1F5AF571A1716E85E140B0C	(not available)
21	%ProgramFiles%\BearShare\Webstats.exe	294,912 bytes	MD5: 0x3114E2732C4315B27F4BD31355DE547F SHA-1: 0x89AE915ABB094209909DB722CE641AFAE94767DB	(not available)
22	%ProgramFiles%\BearShare\Webstats.ini	3,159 bytes	MD5: 0x0C65B7A84781D5C016A04643D76A4F57 SHA-1: 0xD8624C2DE219C57F7E61DE84472FA1353DE37B60	(not available)
23	[file and pathname of the sample #1]	3,521,856 bytes	MD5: 0x8524546A4EA530AF4ABA3081C2BED9BF SHA-1: 0x9E2FFDDE17A279B6EA58DCA18C174E20873B098A	not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] AdWare.Win32.WhenU [Ikarus] packed with WiseSFXDropper [Kaspersky Lab]

Notes:

%CommonPrograms% is a variable that refers to the file system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\Documents and Settings\All Users\Start Menu\Programs (Windows NT/2000/XP).
%DesktopDir% is a variable that refers to the file system directory used to physically store file objects on the desktop. A typical path is C:\Documents and Settings\[UserName]\Desktop.
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%ProgramFiles%\BearShare
%ProgramFiles%\VVSN
c:\My Downloads
%ProgramFiles%\BearShare\db
%ProgramFiles%\BearShare\Extras
%ProgramFiles%\BearShare\Installer
%ProgramFiles%\BearShare\Logs
%ProgramFiles%\BearShare\Playlists
%ProgramFiles%\BearShare\sounds
%ProgramFiles%\BearShare\Temp
%ProgramFiles%\BearShare\Webstats

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
BearShare.exe	%ProgramFiles%\bearshare\bearshare.exe	9,629,696 bytes
VVSN.exe	%ProgramFiles%\VVSN\VVSN.exe	122,880 bytes
VVSNInst.exe	%Temp%\VVSNInst.exe	110,592 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	3,530,752 bytes
GLB1.tmp	%Temp%\GLB1.tmp	28,672 bytes

The following module was loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
BSidle.dll	%ProgramFiles%\BearShare\BSidle.dll	Process name: BearShare.exe Process filename: %ProgramFiles%\bearshare\bearshare.exe Address space: 0x1CD0000 - 0x1CD6000

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Implemented Categories
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare
HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type
HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current
HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]

(Default) = ""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\TypeLib]

(Default) = "{50a7e9b0-70ef-11d1-b75a-00a0c90564fe}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}\InProcServer32]

(Default) = "%System%\SHELL32.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{558EC983-BEDB-9168-B2DE-31DBF0EE543E}]

(Default) = "WebView Folder View"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\VersionIndependentProgID]

(Default) = "RunMSC.Loader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\ProgID]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}\InprocServer32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F95F736-0F62-4214-A4B4-CAA6738D4C07}]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\TypeLib]

(Default) = "{905D0DF2-3A0A-4D94-853C-54A12A745905}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C285D18D-43A2-4AEF-83FB-BF280E660A97}]

(Default) = "ILoader"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\0\win32]

(Default) = "%ProgramFiles%\BearShare\RunMSC.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\BearShare\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{905D0DF2-3A0A-4D94-853C-54A12A745905}\1.0]

(Default) = "RunMSC 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gnu]

(Default) = "gnufile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ed2k]

URL Protocol = ""
(Default) = "URL:ed2k Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" --noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnu]

URL Protocol = ""
(Default) = "URL:GNU Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" "%1""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnufile]

(Default) = "gnutella"
BrowserFlags = 0x00000008
EditFlags = 0x00010000

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\gnutella]

URL Protocol = ""
(Default) = "URL:Gnutella Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Topic]

(Default) = "URLHandler"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec\Application]

(Default) = "BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\ddeexec]

(Default) = "%1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\shell\open\command]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet\DefaultIcon]

(Default) = ""%ProgramFiles%\BearShare\BearShare.exe",-130"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\magnet]

URL Protocol = ""
(Default) = "URL:Magnet Protocol"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CurVer]

(Default) = "RunMSC.Loader.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1\CLSID]

(Default) = "{9F95F736-0F62-4214-A4B4-CAA6738D4C07}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RunMSC.Loader.1]

(Default) = "Loader Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5F95E1AF-2620-4f15-BDF9-7FDCE4607E17}]

(Default) = "BearShare"
Version = "5,2,0,7"
ComponentID = "BearShare"
IsInstalled = 0x00000001
Locale = "EN"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

BearShare = ""%ProgramFiles%\BearShare\BearShare.exe" /pause"

so that BearShare.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BearShare]

DisplayName = "BearShare"
UninstallString = "C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG"
DisplayVersion = "5.2.0.7"
HelpLink = "http://bearshare.com/help.htm"
Publisher = "Free Peers, Inc."
URLInfoAbout = "http://www.freepeers.com"
DisplayIcon = "%ProgramFiles%\BearShare\BearShare.exe,-128"

[HKEY_LOCAL_MACHINE\SOFTWARE\BearShare]

InstallDir = "%ProgramFiles%\BearShare"

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

{R7C0DB872A3F777C0} = 4A 8D 7D 4C
{K7C0DB872A3F777C0} = B6 E7 98 78 FB 0D 1F FF FF FF FF 69 EB 67 03 03 07 99 01 65 14 0F C8 1F F3 29 FB 4A 8D 7D 4C FF FF FF FF 87 30 0C C3 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare\Type]

urn:sha1 = 0x00000000
urn:bitprint = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Magnet\Handlers\Bearshare]

(Default) = "Bearshare"
Description = "Bearshare can automatically search for and download the selected content on its peer-to-peer network."
DefaultIcon = ""%ProgramFiles%\BearShare\BearShare.exe",-130"
ShellExecute = ""%ProgramFiles%\BearShare\BearShare.exe" -noinstcheck -spawnedfromurl %1"
DdeApplication = "BearShare"
DdeTopic = "URLHandler"

[HKEY_USERS\.DEFAULT\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_USERS\.DEFAULT\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

[HKEY_CURRENT_USER\AppEvents\EventLabels\BearShareChatNotifyMsg]

(Default) = "Chat Message Waiting"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg\.Current]

(Default) = "%ProgramFiles%\BearShare\sounds\notify.wav"

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare\BearShareChatNotifyMsg]

(Default) = ""

[HKEY_CURRENT_USER\AppEvents\Schemes\Apps\BearShare]

(Default) = "BearShare"

Other details

To mark the presence in the system, the following Mutex objects were created:

WhenU_VVSN_1_0_SharedMutex
DBWinMutex
RAL1A8B7953
1A8B7953::WK
FreePeers_BearShare
c:

The following ports were open in the system:

Port	Protocol	Process
1025	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1026	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1027	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1028	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1029	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1030	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1031	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1033	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1034	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1035	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1036	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1037	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1038	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1039	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1040	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1041	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1042	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1043	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1044	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1046	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1047	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1048	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1049	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1050	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1051	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1052	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1053	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1054	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1055	TCP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1055	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1056	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1057	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1058	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1059	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1060	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1061	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1062	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1063	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1064	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1065	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1066	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1067	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1068	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1069	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1070	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1071	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1072	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1073	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1074	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1075	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1076	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1077	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1078	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1079	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1080	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1081	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1082	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1083	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1084	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1085	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1086	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1087	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1088	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1089	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1090	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1091	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1092	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1093	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1094	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1095	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1096	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1097	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1098	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1099	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1100	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1101	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1102	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1103	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1104	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1105	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1106	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1107	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1108	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1109	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1110	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1111	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1112	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1113	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1114	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1115	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1116	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1117	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1118	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1119	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1120	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1121	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1122	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1123	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1124	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)
1125	UDP	BearShare.exe (%ProgramFiles%\BearShare\BearShare.exe)

The following Host Names were requested from a host database:

24.165.49.128
privateport1.bearshare.net
nodes.dyndns.org
gwc1.solutions.lv
gcachw.xolox.nl
g1.blacknex.net
gwc1.nouiz.org
www.tfs-net.de
loot.alumnigroup.org
cache.kicks-ass.net
g2.tjtech.org
private1.bearshare.net
gwc.nonexiste.net

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
81.159.158.89	6348
70.20.198.194	6348
70.234.107.66	6348
82.36.96.133	6348
82.40.198.207	6348
200.74.118.148	6348
87.6.45.236	6348
81.79.39.29	6348
83.95.181.7	6348
87.6.201.192	6348
24.57.206.166	6346
172.163.255.214	6346
84.134.111.74	6346
61.42.118.85	6346
83.24.33.216	6346
67.9.95.69	6346
24.217.238.67	6346
65.49.143.74	6346
80.228.176.222	6346
67.171.190.3	6346
84.202.22.192	8271
84.169.163.66	6000

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
app.whenu.com	80	(null)	(null)
spweb.whenu.com	80	(null)	(null)
www.bearshare.com	80	(null)	(null)

The following GET requests were made:

AppInstall?app=VVSN&url=EEPE120501&id=05874E292D104B2CB1197A9C6356C197&ui=JH
vvsn/EEPE120501/vsn.cfg
AppInstall?app=VVSN_CFG&url=EEPE120501&id=05874E292D104B2CB1197A9C6356C197&ui=QF

The following HTTP URLs were started reading:

http://nodes.dyndns.org/mcache.php?client=BEAR&version=5.2.0.7&urlfile=1
http://gwc1.solutions.lv/pgc.cgi?client=BEAR&version=5.2.0.7&urlfile=1
http://gcachw.xolox.nl/gwebcache?client=BEAR&version=5.2.0.7&urlfile=1
http://g1.blacknex.net/cgi-bin/perlgcache.cgi?client=BEAR&version=5.2.0.7&urlfile=1
http://gwc1.nouiz.org/servlet/GWebCache/req?client=BEAR&version=5.2.0.7&urlfile=1
http://www.tfs-net.de/cgi-bin/perlgcache.cgi?client=BEAR&version=5.2.0.7&urlfile=1
http://loot.alumnigroup.org/?client=BEAR&version=5.2.0.7&urlfile=1
http://g2.tjtech.org/g2/index.php?client=BEAR&version=5.2.0.7&hostfile=1
http://www.whenudownloads.com/vvsn/prod/SAVEInst.exe

Outbound traffic (potentially malicious)

There was an outbound traffic produced on port 1033:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 302E 370D 0A41 6363 6570 742D 456E 636F | 0.7..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 312E 3135 392E 3135 382E 3839 | P: 81.159.158.89
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2CC3 6BD2 60B2 E166 65DB 2F79 B6E1 | 28,.k.`..fe./y..
00000190 | 569F 8387 FC9F FCCB 9E2B E766 A1AE 824C | V........+.f...L
000001A0 | D37B 3621 270D 0A46 502D 4175 7468 2D43 | .{6!'..FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 474C 4451 4458 | hallenge: GLDQDX
000001C0 | 4942 4E4D 4450 3547 3549 474A 4633 4253 | IBNMDP5G5IGJF3BS
000001D0 | 5851 4B49 424A 4258 3346 0D0A 0D0A      | XQKIBJBX3F....

There was an outbound traffic produced on port 1035:

There was an outbound traffic produced on port 1037:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 302E 370D 0A41 6363 6570 742D 456E 636F | 0.7..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 342E 3230 322E 3232 2E31 3932 | P: 84.202.22.192
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2C3E F5AF DF2B 9A6C E2AB EDD9 B24A | 28,>...+.l.....J
00000190 | 494E DE94 9AE6 9684 7DAA F23E A170 5C54 | IN......}..>.p\T
000001A0 | B5D5 FD21 CA0D 0A46 502D 4175 7468 2D43 | ...!...FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 4D54 4F37 544D | hallenge: MTO7TM
000001C0 | 4A46 5035 5A45 5435 4F4B 334D 5546 3646 | JFP5ZET5OK3MUF6F
000001D0 | 5943 4E52 4258 5836 565A 0D0A 0D0A      | YCNRBXX6VZ....

There was an outbound traffic produced on port 6348:

There was an outbound traffic produced on port 6346:

There was an outbound traffic produced on port 8271:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 302E 370D 0A41 6363 6570 742D 456E 636F | 0.7..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 342E 3230 322E 3232 2E31 3932 | P: 84.202.22.192
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2C3E F5AF DF2B 9A6C E2AB EDD9 B24A | 28,>...+.l.....J
00000190 | 494E DE94 9AE6 9684 7DAA F23E A170 5C54 | IN......}..>.p\T
000001A0 | B5D5 FD21 CA0D 0A46 502D 4175 7468 2D43 | ...!...FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 4D54 4F37 544D | hallenge: MTO7TM
000001C0 | 4A46 5035 5A45 5435 4F4B 334D 5546 3646 | JFP5ZET5OK3MUF6F
000001D0 | 5943 4E52 4258 5836 565A 0D0A 0D0A      | YCNRBXX6VZ....

There was an outbound traffic produced on port 6000:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 302E 370D 0A41 6363 6570 742D 456E 636F | 0.7..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 342E 3136 392E 3136 332E 3636 | P: 84.169.163.66
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2C35 A293 7874 AA30 5C8D F578 F82A | 28,5..xt.0\..x.*
00000190 | 4466 C598 59B1 35D9 58BC B3E7 7BB0 6DE4 | Df..Y.5.X...{.m.
000001A0 | 61DB A824 430D 0A46 502D 4175 7468 2D43 | a..$C..FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 494E 534C 344C | hallenge: INSL4L
000001C0 | 5455 5046 3351 454F 4F37 5147 4B59 4B4C | TUPF3QEOO7QGKYKL
000001D0 | 334D 4F50 3658 4B55 5354 0D0A 0D0A      | 3MOP6XKUST....

There was an outbound traffic produced on port 8570:

There was an outbound traffic produced on port 1024:

There was an outbound traffic produced on port 600:

00000000 | 474E 5554 454C 4C41 2043 4F4E 4E45 4354 | GNUTELLA CONNECT
00000010 | 2F30 2E36 0D0A 5573 6572 2D41 6765 6E74 | /0.6..User-Agent
00000020 | 3A20 4265 6172 5368 6172 6520 352E 322E | : BearShare 5.2.
00000030 | 302E 370D 0A41 6363 6570 742D 456E 636F | 0.7..Accept-Enco
00000040 | 6469 6E67 3A20 6465 666C 6174 650D 0A58 | ding: deflate..X
00000050 | 2D52 6571 7565 7269 6573 3A20 6661 6C73 | -Requeries: fals
00000060 | 650D 0A56 656E 646F 722D 4D65 7373 6167 | e..Vendor-Messag
00000070 | 653A 2030 2E31 0D0A 582D 556C 7472 6170 | e: 0.1..X-Ultrap
00000080 | 6565 723A 2046 616C 7365 0D0A 582D 5175 | eer: False..X-Qu
00000090 | 6572 792D 526F 7574 696E 673A 2030 2E31 | ery-Routing: 0.1
000000A0 | 0D0A 4D61 6368 696E 653A 2031 2C31 332C | ..Machine: 1,13,
000000B0 | 3235 352C 312C 3331 3932 0D0A 506F 6E67 | 255,1,3192..Pong
000000C0 | 2D43 6163 6869 6E67 3A20 302E 310D 0A4C | -Caching: 0.1..L
000000D0 | 6973 7465 6E2D 4950 3A20 302E 302E 302E | isten-IP: 0.0.0.
000000E0 | 303A 3633 3438 0D0A 5265 6D6F 7465 2D49 | 0:6348..Remote-I
000000F0 | 503A 2038 372E 3132 332E 3134 322E 3533 | P: 87.123.142.53
00000100 | 0D0A 4747 4550 3A20 302E 350D 0A58 2D44 | ..GGEP: 0.5..X-D
00000110 | 6567 7265 653A 2032 360D 0A58 2D55 6C74 | egree: 26..X-Ult
00000120 | 7261 7065 6572 2D51 7565 7279 2D52 6F75 | rapeer-Query-Rou
00000130 | 7469 6E67 3A20 302E 310D 0A58 2D4D 6178 | ting: 0.1..X-Max
00000140 | 2D54 544C 3A20 340D 0A58 2D44 796E 616D | -TTL: 4..X-Dynam
00000150 | 6963 2D51 7565 7279 696E 673A 2030 2E31 | ic-Querying: 0.1
00000160 | 0D0A 582D 5072 6F62 652D 5175 6572 6965 | ..X-Probe-Querie
00000170 | 733A 2030 2E31 0D0A 4650 2D31 613A 2031 | s: 0.1..FP-1a: 1
00000180 | 3238 2CAF FBD3 F7F7 57A6 6FEF 8DA9 FE2A | 28,.....W.o....*
00000190 | D19B AF68 CE7D AA32 DC4E D155 B777 71F6 | ...h.}.2.N.U.wq.
000001A0 | A956 2E21 E80D 0A46 502D 4175 7468 2D43 | .V.!...FP-Auth-C
000001B0 | 6861 6C6C 656E 6765 3A20 5241 524B 5644 | hallenge: RARKVD
000001C0 | 3359 504D 334A 494F 594D 594B 4C41 4C43 | 3YPM3JIOYMYKLALC
000001D0 | 5535 4D50 3456 5035 4448 0D0A 0D0A      | U5MP4VP5DH....

Downloaded File Summary:

Download details:

Download retrieved: 6 January 2009 15:47:49
Processing time: 6 min 52 sec
Downloaded sample:

File MD5: 0x57CD9489DA9FEF8A95B037F444A405C5
File SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA
Filesize: 849,784 bytes
Alias:

Adware.WhenU.AQ [PCTools]
Adware.Savenow [Symantec]
not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab]
Adware-SaveNow [McAfee]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Registers a 32-bit in-process server DLL.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.VB	Adware.VB is a generic detection for adware programs compiled in Visual Basic. It displays popup advertisements and may download other adware and spyware without the users knowledge.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WhenU\Customer Support.lnk	1,496 bytes	MD5: 0xCD99E2BDA22F67725A59AD1F599BC536 SHA-1: 0xC7323E12668B57E219DDE458EDC1AFB771BB455E	(not available)
2	%Programs%\WhenU\Learn More About WhenU Save.url	94 bytes	MD5: 0x5B00B8E7955E54FEBAD3413CF00CE971 SHA-1: 0x9B420142C19DD672DAC3D7CFD7BC152983DDD0C1	(not available)
3	%Programs%\WhenU\Learn More About WhenU SaveNow.url	97 bytes	MD5: 0x5785E83850AFE8FF6A88FE54E8928C12 SHA-1: 0x852E05BBADF4DA46CE23909D71987F72C9ED22E2	(not available)
4	%Programs%\WhenU\Uninstall Instructions.lnk	1,496 bytes	MD5: 0xD68C82E928AA6C53B0F2DD3D7391268E SHA-1: 0xC4AF4438FFFBC08E7FF229400A1F46AE2E58D3A1	(not available)
5	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0xF7E62DFEB3F37B31997B1C1E2144E639 SHA-1: 0x7DF728853A959B542AB96065A7A098724E5F4D6E	(not available)
6	%ProgramFiles%\Save\ACM.dll	516,472 bytes	MD5: 0xAD616A7E4A5306582E0F7363E36E0E75 SHA-1: 0x33C78E3161F1D59AA14005D058844138B6B71913	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
7	%ProgramFiles%\Save\ffext.mod	12,814 bytes	MD5: 0x501D4C0B7D3C5449210007EC658C47ED SHA-1: 0x1201DB4A4DABEA7DFDE53AC2107CD00074274167	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.z [Kaspersky Lab] AdWare.Win32.WhenU [Ikarus]
8	%ProgramFiles%\Save\Save.exe	803,184 bytes	MD5: 0x47754BF98FD5A4BC05C3B08221D6426A SHA-1: 0xC533F42FCA267458C489077B8DDC12F1A64526FD	Adware.WhenU_SaveNow [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] not-a-virus:AdTool.Win32.WhenU.i [Ikarus]
9	%ProgramFiles%\Save\save.htm	135,229 bytes	MD5: 0x64A8BEC37176AC27F4F5781139C9D744 SHA-1: 0xE01493BB480EDDE0D563D9F9C76886BC8D9EE186	HTML.Pestblock [Ikarus]
10	%ProgramFiles%\Save\SaveUninst.exe	118,200 bytes	MD5: 0x7AADCB4EB4B8EBDA8BE77548754427DA SHA-1: 0xC5610CD5AC119E395E843FE1C0893ACD1141EBE1	Adware.Savenow [Symantec] Adware-SaveNow [McAfee] Adware:Win32/WhenU.A [Microsoft] Virus.Win32.Trojan [Ikarus]
11	[file and pathname of the sample #1]	849,784 bytes	MD5: 0x57CD9489DA9FEF8A95B037F444A405C5 SHA-1: 0x7B930E353649FB526C4C5C458680BFAEF569E7CA	Adware.WhenU.AQ [PCTools] Adware.Savenow [Symantec] not-a-virus:WebToolbar.Win32.WhenU.a [Kaspersky Lab] Adware-SaveNow [McAfee]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WhenU
%ProgramFiles%\Save

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\Save\Save.exe	827,392 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	860,160 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ACM.DLL]

AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}]

(Default) = "ACM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID]

(Default) = "ACM.ACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\InprocServer32]

(Default) = "%ProgramFiles%\Save\ACM.dll"
ThreadingModel = "Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}]

(Default) = "ACMFactory Class"
AppID = "{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}]

(Default) = "IFetchExtractor"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}]

(Default) = "IACMFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\TypeLib]

(Default) = "{DF901432-1B9F-4F5B-9E56-301C553F9095}"
Version = "1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid]

(Default) = "{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}]

(Default) = "IFetchData"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\0\win32]

(Default) = "%ProgramFiles%\Save\ACM.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\HELPDIR]

(Default) = "%ProgramFiles%\Save\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0\FLAGS]

(Default) = "0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{DF901432-1B9F-4F5B-9E56-301C553F9095}\1.0]

(Default) = "ACM 1.0 Type Library"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CurVer]

(Default) = "ACM.ACMFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1\CLSID]

(Default) = "{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ACM.ACMFactory.1]

(Default) = "ACMFactory Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002700877"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akdwl.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "4.22"
timedDBUpdate_rs = "Y"
SystemParam_rs = "dt=WhenU Save;q=;i=1"
uninst_rs = "4.2202"
extra_url = "http://www.whenudownloads.com/extra.exe"
extraver_url = "http://www.whenudownloads.com/extraver.html"
ziptomsa_url = "http://akapp.whenu.com/ziptomsa"
InstallTime = "20081019184426"
LastPartner = ""
SetupCmdLine = "http://web.whenu.com/Offers?iou=i&clp=&pip=0"
zip = ""
acm_rs = "1.05"
TotalPartner = "0"
newuser_rs = "Y"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

Other details

To mark the presence in the system, the following Mutex object was created:

WhenU_WhenUSave_SharedMutex

The following Internet Connection was established:

Server Name	Server Port	Connect as User	Connection Password
offers.whenu.com	80	(null)	(null)

The following GET requests were made:

installed.html?app=whenusave&ptr=&pds=&toi=20081019184426
index.jpg

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.