Adware.WhenU removal

The Adware.WhenU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Adware.WhenU virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Adware.WhenU?


File Info:
name: 751D83AB92EDBFD9655F.mlw
path: /opt/CAPEv2/storage/binaries/c206feacd71fa5814a82703edb8d3874d6d2a67807905790205744f51b1f5fbf
crc32: EE4EDC9D
md5: 751d83ab92edbfd9655f42f3f931f824
sha1: 283ec6f88fead1b1bd3807e277667292542c6a31
sha256: c206feacd71fa5814a82703edb8d3874d6d2a67807905790205744f51b1f5fbf
sha512: 2bde82f734a101118676bd9f15c37262b4a75a5fe5dc85c8a7995cf66cae5657e96bd107d72bfd8602c802ae61e663806514fbe49c1d7b2b8a3094547a89d3c3
ssdeep: 6144:vVd0gMQuY1dBsHB+uq1slognqDHrJcvKnChG+iHv:vVWi1dShFpognaLJcvG+i
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BD3412E209D641E3DCDB0931A4E08F517BAF2FA61D44C903DD90D21A6DA87F1A2B8377
sha3_384: e209116a3292dccc5ed1cf44d1b40de30cdaac1839c2831b601020dfa863339219b952be7880d5f968477ef8a18e78a0
ep_bytes: 558bec83ec4456ff15445040008bf085
timestamp: 2003-03-14 21:23:26

Version Info:
Comments: 
CompanyName: WhenU.com, Inc.
FileDescription: Save! Setup
FileVersion: 2, 1, 3, 1
InternalName: SaveInstCm
LegalCopyright: Copyright 2000
LegalTrademarks: 
OriginalFilename: SaveInstCm.exe
PrivateBuild: 
ProductName: Save! Setup
ProductVersion: 2, 1, 3, 1
SpecialBuild: Includes mandatory ClockSync
Translation: 0x0409 0x04b0

Adware.WhenU also known as:

Lionic	Adware.Win32.SaveNow.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Adware.Heur.pq0@R4VKYiii
FireEye	Generic.mg.751d83ab92edbfd9
ALYac	Gen:Adware.Heur.pq0@R4VKYiii
Cylance	Unsafe
Zillya	Adware.SaveNow.Win32.377
Sangfor	Trojan.Win32.Heuristic.rg
Alibaba	AdWare:Win32/SaveNow.71a8dcea
Cyren	W32/SaveNow.A.gen!Eldorado
Symantec	Adware.Savenow
ESET-NOD32	a variant of Win32/Adware.SaveNow.A
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Adware.SaveNow-2
Kaspersky	not-a-virus:AdWare.Win32.SaveNow.ae
BitDefender	Gen:Adware.Heur.pq0@R4VKYiii
NANO-Antivirus	Riskware.Win32.SaveNow.gmojq
SUPERAntiSpyware	Adware.WhenU
Avast	Win32:PUP-gen [PUP]
Tencent	Trojan.Win32.BitCoinMiner.la
Ad-Aware	Gen:Adware.Heur.pq0@R4VKYiii
Comodo	Application.Win32.Adware.Savenow.~OSA@1xn0r8
DrWeb	Adware.SaveNow
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	ADWARE_WHENU
Emsisoft	Gen:Adware.Heur.pq0@R4VKYiii (B)
SentinelOne	Static AI – Suspicious PE
Webroot	Adware:Win32/WhenU.F
Avira	ADSPY/SaveNow.1
MAX	malware (ai score=99)
Antiy-AVL	Trojan/Generic.ASMalwS.73EFD
Microsoft	Trojan:Win32/Ymacco.ABC2
ViRobot	Adware.SaveNow.247296
GData	Gen:Adware.Heur.pq0@R4VKYiii
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.HDC.C100632
McAfee	Artemis!751D83AB92ED
VBA32	BScope.Adware.SaveNow
Malwarebytes	Adware.WhenU
TrendMicro-HouseCall	ADWARE_WHENU
Yandex	Trojan.GenAsa!gN8WRgxbJ8k
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Adware/SaveNow
AVG	Win32:PUP-gen [PUP]
Cybereason	malicious.b92edb
Panda	Generic Malware

How to remove Adware.WhenU?

Adware.WhenU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X