Content

Adware-WhenUSearch

Type
Program
SubType
Adware
Discovery Date
02/02/2005
Minimum DAT
4349 (04/07/2004)
Updated DAT
5152 (10/30/2007)
Minimum Engine
5.1.00
Description Added
04/27/2004
Description Modified
06/15/2005 12:17 AM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT(tm) recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

This is not a virus or a Trojan. It is an adware application by
WhenU.com, Inc.
 
Installation:

File:   UInstall.exe
Hash: fc9106a26af75d82df3549170030398c

Upon installation of this adware application the following changes occur in the user's system.

The following files are added to the %ProgramFiles%\WhenUSearch directory:

  • search.exe
  • search.dll
  • whse.exe
  • uninst.exe

This adware application installs toolbar with other buttons.



search.dll is installed as Browser Helper Object .

Browser Helper Objects are executable files that are loaded when the browser is launched. They can perform various task, such as generating extra pop-up ads, monitoring page navigation, etc.

The following Registry key is added in order to get executed on each reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WhenUSearch = "C:\Program Files\WhenUSearch\Search.exe"

The following Registry keys are added:

HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\WHSB
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners
HKEY_LOCAL_MACHINE\SOFTWARE\WhenUSearch\Partners\browser

This adware application tracks user's browsing activity and displays coupons, special offer or advertising content when user shops online.

For Example if user browses for Business cards. 



Advertising link for Business Cards is displayed on toolbar.

Aliases

Aliases

    N/A