ThreatExpert Report: Adware.WhenU_SaveNow, not-a-virus:AdTool.Win32.WhenU.a, Adware-SaveNow..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 27 April 2008, 10:37:41
Processing time: 3 min 26 sec
Submitted sample:

File MD5: 0xE76F88BC8F04FEDC2BB3722CC9472240
File SHA-1: 0xB75995370FDBFE08D5D9A9115D2110AD924D49BB
Filesize: 379,976 bytes
Alias:

Adware.WhenU_SaveNow [PCTools]
not-a-virus:AdTool.Win32.WhenU.a [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.
Creates a startup registry entry.
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Adware.SaveNow!sd5	Adware.SaveNow!sd5 is a potentially unwanted adware program that could be used to display various pop-up advertisements.
Adware.WhenU_SaveNow	SaveNow shows targeted pop-up advertisements and coupons based on user's Internet surfing habits. It is usually distributed with other third party software such as BearShare.
Adware.WhenU_WeatherCast	Weathercast displays weather forecasts in real time. It also bundles WhenUSearch with it and displays text-based advertisements within the WeatherCast program.
Adware.Component.WhenU	Common Components shared between WhenU products like ClockSync, SaveNow, SideFinder and WeatherCast.

Attention! The following threat category was identified:

Threat Category	Description
	A potentially unwanted adware program designed to deliver various advertisements to the users' systems

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Programs%\WeatherCast\WeatherCast.lnk	1,520 bytes	MD5: 0xA3B00D584927870BC595B59691CE49B4 SHA-1: 0x1FB9B4A3A9CCB8260B15AC0DECDA68502C7A81D7	(not available)
2	%Programs%\WhenU\Learn More About Save!.url	94 bytes	MD5: 0x1C507B4E577A068EDB5BFB29895790C2 SHA-1: 0x408F58D4E6F9F65DD502876404BC96B4027E8951	(not available)
3	%Programs%\WhenU\Learn More About SaveNow.url	97 bytes	MD5: 0x004ECE9B06692B4B4175D6F916794E37 SHA-1: 0xC0F76051FBD0CB23E2CCECC8AD49BF8CA17FCA23	(not available)
4	%Programs%\WhenU\WhenU.com Website.url	76 bytes	MD5: 0xE5A23A17131446025AC70349B40A7C39 SHA-1: 0xA15041AE29601160FC00530C2711E027FE49F400	(not available)
5	%ProgramFiles%\Save\ReadMe.txt	3,962 bytes	MD5: 0x98D23ED9EADD9849BC14DB4C56ABE523 SHA-1: 0x588D3E4D7FB849A0CABF827403721AF3062B4838	Adware-SaveNow [McAfee]
6	%ProgramFiles%\Save\save.db	47 bytes	MD5: 0xE2400BFF4F83BF551D3CE9A3137D0341 SHA-1: 0x7CF50AFF34853183EF0A7FA4A7B029D1D77C52D4	(not available)
7	%ProgramFiles%\Save\Save.exe	358,976 bytes	MD5: 0xF5BAAEAC796EFA579E498C93AC496E13 SHA-1: 0xF0D536E6BEC7317E176CE4FF888EF3D1E31B6EEF	Adware.SaveNow!sd5 [PCTools] not-a-virus:AdWare.Win32.SaveNow.be [Kaspersky Lab] Adware-SaveNow [McAfee]
8	%ProgramFiles%\Save\save.htm	74,537 bytes	MD5: 0x3CEB2DD0E78BE3235875F36F7011F7EA SHA-1: 0x3E1C53CE5B85479AD27136F00B8756C66B8B2181	(not available)
9	%ProgramFiles%\Save\SaveUninst.exe	29,312 bytes	MD5: 0x9BD8828F79D9822F82985C3E9398B9F4 SHA-1: 0xD85A8ED1A8198CD9A51B943432D1307AC6DA32C7	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdWare.Win32.SaveNow.m [Kaspersky Lab] Adware-SaveNow [McAfee]
10	%ProgramFiles%\WeatherCast\Uninst.exe	18,999 bytes	MD5: 0x57B233F163AB75B59FB329B032114AAC SHA-1: 0x9037DB5E6F7C46DEF333A7D05EECAB1F2CD29E7B	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdWare.Win32.SaveNow.ay [Kaspersky Lab] Generic PUP.a [McAfee]
11	%ProgramFiles%\WeatherCast\Weather.exe	132,096 bytes	MD5: 0x8B80EEF990F3F353B7E5A855975ADC2E SHA-1: 0x449B85A5C6A656DC4379C8D7FA9DA0A9F6D320EC	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdWare.Win32.SaveNow.ay [Kaspersky Lab] Adware-SaveNow [McAfee]
12	[file and pathname of the sample #1]	379,976 bytes	MD5: 0xE76F88BC8F04FEDC2BB3722CC9472240 SHA-1: 0xB75995370FDBFE08D5D9A9115D2110AD924D49BB	Adware.WhenU_SaveNow [PCTools] not-a-virus:AdTool.Win32.WhenU.a [Kaspersky Lab]

Notes:

%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

%Programs%\WeatherCast
%Programs%\WhenU
%ProgramFiles%\Save
%ProgramFiles%\WeatherCast

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
Save.exe	%ProgramFiles%\save\save.exe	368,640 bytes
Weather.exe	%ProgramFiles%\weathercast\weather.exe	143,360 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	385,024 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WUSN.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherCast
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave\Partners
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave\Partners\CAST
HKEY_CURRENT_USER\Software\WhenU
HKEY_CURRENT_USER\Software\WhenU\Weather

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WUSN.1]

WUSN_Id = 1C 0F AA A0 33 25 A2 4F B4 07 CF AE 53 A8 50 9F

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

WhenUSave = ""%ProgramFiles%\Save\Save.exe""

so that Save.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WeatherCast]

DisplayIcon = "%ProgramFiles%\WeatherCast\Weather.exe,-0"
DisplayName = "WeatherCast"
DisplayVersion = "1.52"
HelpLink = "www.whenu.com/about_weather.html"
Publisher = "WhenU.com, Inc."
UninstallString = ""%ProgramFiles%\WeatherCast\Weather.exe" /u"
UrlInfoAbout = "http://www.whenu.com/about_weather.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave\Partners\CAST]

Partner = "CASTBACK"
InstallTime = "20080107151458"
PartnerDesc = "WeatherCast"
PartnerFile = "%ProgramFiles%\WeatherCast\Weather.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSave]

db_script_update = "1002500606"
InstallDir = "%ProgramFiles%\Save"
pats_url = "http://akapp.whenu.com/OffersDataGZ"
pat_chunks_url = "http://akapp.whenu.com/DataChunksGZ"
script_url = "http://akweb.whenu.com/offscript2.html"
update_url = "http://akweb.whenu.com/saveupdate.exe"
ver_url = "http://www.whenu.com/versions.html"
Version = "2.63"
extra_url = "http://spweb.whenu.com/extra.exe"
extraver_url = "http://spweb.whenu.com/extraver.html"
ziptomsa_url = "http://spapp.whenu.com/ziptomsa"
InstallTime = "20080107151458"
LastPartner = ""
SetupCmdLine = "http://app.whenu.com/Offers?url=&cpartners=0"
zip = ""
TotalPartner = "1"
newuser_rs = "Y"
Partner = "CASTBACK"
PartnerB = "CAST"
PartnerDesc = "WeatherCast"
FullDBTime = "N"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

WeatherCast = ""%ProgramFiles%\WeatherCast\Weather.exe" /q"

so that Weather.exe runs every time Windows starts

[HKEY_CURRENT_USER\Software\WhenU\Weather]

InstallDir = "%ProgramFiles%\WeatherCast"
Version = "1.52"
about_url = "http://spweb.whenu.com/about_weather.html"
checkver_url = "http://spapp.whenu.com/WeatherDB"
update_url = "http://spweb.whenu.com/weatherupdate.exe"
exitsurvey_url = "http://web.whenu.com/uninstall_weather.html"
nagSequence = "5;5|;2;3;4"
nag1_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=1"
nag2_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=2"
nag3_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=3"
nag4_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=4"
nag5_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=5"
nag6_url = "http://app.whenu.com/WthrPrefs?mode=nt&nid=6"
Partner = "CASTBACK"
LastPartner = "CASTBACK"
InstallTime = "20080107151458"
zip = ""
ccode = ""
userFontStyle = "0"
timeHeartbeat = "20080107231503"
nagCount = "1"
timeLastNag = "20080107151503"

Other details

To mark the presence in the system, the following Mutex objects were created:

WhenU_WeatherCast_SharedMutex
_!SHMSFTHISTORY!_
WhenU_WhenUSave_SharedMutex

The following port was open in the system:

Port	Protocol	Process
1040	UDP	Weather.exe (%ProgramFiles%\WeatherCast\Weather.exe)

The following Internet Connections were established:

Server Name	Server Port	Connect as User	Connection Password
web.whenu.com	80	(null)	(null)
app.whenu.com	80	(null)	(null)
spapp.whenu.com	80	(null)	(null)

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.