How to remove "WebToolbar.Win32.WhenU.k"?

The WebToolbar.Win32.WhenU.k is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What WebToolbar.Win32.WhenU.k virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Reads data out of its own binary image
Drops a binary and executes it
Network activity contains more than one unique useragent.
Installs itself for autorun at Windows startup
Attempts to modify proxy settings

Related domains:

app.whenu.com

www.whenudownloads.com

www.bing.com

How to determine WebToolbar.Win32.WhenU.k?


File Info:
crc32: 579F0CD7
md5: 2aa6961d7e43f9dbd8eb6e7352076352
name: cleanerssetup.exe
sha1: 3a3e5b69121e2f053b65db2d0ac465a8139db0df
sha256: 0966125d07ac80dc2eb34570dc5098fa66c17728653437f62cc867d6e8e8755d
sha512: bb7e0aafe69a327827c31f2a623115c12cc113476bdc70415581e1847f605bd8f690fc04760465f049fae920ca02ef45908cb383e71970fcc3cac73947ddfae2
ssdeep: 196608:iOtyfcoz847cb2063Uh1Ro7VCtlt/R+lBbsV40LcQHYky1vZYj+xwFJ:iWyLJYH6EO7Vql70q40LcQ4A6xwT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2007 MyPlayCity.com                                                                     
FileDescription: Cleaner's Scrape Setup                                      
FileVersion:                     
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: MyPlayCity.com                                              
Translation: 0x0409 0x04e4

WebToolbar.Win32.WhenU.k also known as:

CMC	WebToolbar.Win32.WhenU!O
Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9974
Kaspersky	not-a-virus:WebToolbar.Win32.WhenU.k
NANO-Antivirus	Trojan.Win32.MLW.ejmft
Rising	Trojan.Generic-9h0Lq2BHoxD (cloud)
Ad-Aware	Adware.WhenU.BTE
Comodo	UnclassifiedMalware
F-Secure	Adware.WhenU.BTE
DrWeb	Adware.SaveNow.190
Avira	ADSPY/WhenUSearch.F
Antiy-AVL	RiskWare[WebToolbar]/Win32.WhenU
ESET-NOD32	a variant of Win32/Adware.WhenU.SaveNow potentially unwanted
Tencent	Win32.Trojan.TPA.qdy
Yandex	Adware.AdSpy!WJLlep0Vd0g
Ikarus	not-a-virus:AdTool.Win32.WhenU.k
GData	Win32.Application.Agent.2B1BG6

How to remove WebToolbar.Win32.WhenU.k?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

How to remove “WebToolbar.Win32.WhenU.k”?