About "WebToolbar.Win32.WhenU.a" infection

The WebToolbar.Win32.WhenU.a is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What WebToolbar.Win32.WhenU.a virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine WebToolbar.Win32.WhenU.a?


File Info:
crc32: C889247F
md5: c44d2529e03c807b01a3e4f66a85dfea
name: stoneage.exe
sha1: 61b3bfac3322d2376f7b280c2bab728a23ca62b5
sha256: 2ce6489fb2f8631c3d8d3bc02d8ff10fea21c1ab36a5d44bf51691d7b32f040a
sha512: 1a9f8de63aed5d3cafe274f2df9daf77e308e6e779931ec2baa95a2995a8482d74fae824d67d54b204e8755de5735924c810f4adbcac4e495a964391b322ef90
ssdeep: 24576:3d33g0uBOQ+UhUTsUzo9pf2Uy6VoDdNTWCFgpx+dx0zjmtfwYn+PzmcTOqSLcJ:tng0d3+UwU0XfL5lCIx0x0zj6fwqCzmu
type: PE32 executable (GUI) Intel 80386, for MS Windows, InnoSetup self-extracting archive

Version Info:
InternalName: 
FileVersion:                     
CompanyName: PureFunLand.com                                             
Comments: This installation was built with Inno Setup: http://www.innosetup.com
ProductName: 
ProductVersion: 
FileDescription: Stoneage game Setup                                         
OriginalFilename: 
Translation: 0x0409 0x04e4

WebToolbar.Win32.WhenU.a also known as:

MicroWorld-eScan	Gen:Adware.Heur.gq1@R0KVdygi
CAT-QuickHeal	Adware.WhenU.r4 (Not a Virus)
Baidu	Win32.Trojan.WisdomEyes.151026.9950.9971
F-Prot	W32/HackToolX.XV
ESET-NOD32	Win32/Adware.WhenU.SaveNow potentially unwanted
TrendMicro-HouseCall	SPYW_MARKTSCOR.A
Avast	Win32:SaveNow-I [PUP]
GData	Gen:Adware.Heur.gq1@R0KVdygi
Kaspersky	not-a-virus:WebToolbar.Win32.WhenU.a
BitDefender	Gen:Adware.Heur.gq1@R0KVdygi
NANO-Antivirus	Riskware.Win32.SaveNow.dlnqxe
Ad-Aware	Gen:Adware.Heur.gq1@R0KVdygi
Emsisoft	Gen:Adware.Heur.gq1@R0KVdygi (B)
Comodo	ApplicUnsaf.Win32.Adware.WhenU.SaveNow
F-Secure	Generic.Adw.SaveNow.56AD4696
DrWeb	Program.Monitor.2835
VIPRE	Trojan.Win32.Generic!BT
Sophos	WhenU (PUA)
Cyren	W32/Tool.UEJN-1698
Avira	SPR/MarketScore.K
Antiy-AVL	Spyware[AdWare:not-a-virus]/Win32.SaveNow
Arcabit	Adware.Heur.EECD8D
AVware	Trojan.Win32.Generic!BT
Tencent	Win32.Risk.Adw.Swkr
Ikarus	not-a-virus:WebToolbar.Win32.WhenU
Fortinet	Riskware/MarketScore
AVG	Generic.EAI
Panda	Spyware/MarketScore
Qihoo-360	Malware.Radar01.Gen

How to remove WebToolbar.Win32.WhenU.a?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “WebToolbar.Win32.WhenU.a” infection