ThreatExpert's Statistics for not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab]:

not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] is also known as:

Threat Alias	Number of Incidents
Adware-SaveNow [McAfee]	234
Adware.WhenU_SaveNow [PC Tools]	221
Adware.Savenow [Symantec]	169
Adware:Win32/WhenU.A [Microsoft]	169
not-a-virus:AdTool.Win32.WhenU.i [Ikarus]	169
not-a-virus:AdTool.Win32.WhenU.i [Kaspersky Lab]	39

not-a-virus:WebToolbar.Win32.WhenU.y [Kaspersky Lab] is known to be created as:

%ProgramFiles%\save\save.exe

Note: %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.