How to remove “Win32/Adware.WhenUSave”?

The Win32/Adware.WhenUSave is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Adware.WhenUSave virus can do?

• Creates RWX memory
• Reads data out of its own binary image
• Network activity detected but not expressed in API logs
• Anomalous binary characteristics

How to determine Win32/Adware.WhenUSave?

File Info:
crc32: 373D25C8
md5: 4e1c407402f86b85fe917ba457951bee
name: pengsw.exe
sha1: cfe73ea5d2403b161e4a9f900b3a136255208983
sha256: 457045a0824b0f7d78e706881f5dd2671b7dd75c64d5384b57cc825722c57098
sha512: db1db2696686d1d11e56c27615183c773757571ffa4a257197a46be9a49ae8f65b18bcc2c617166033db942cf8d9eaec402dae743afb3d31de2e4eda954060d2
ssdeep: 24576:x7aLsw75pkeKzwXoXeQtEFfVNoKzDE71toAiAjI+pGQu:xs75HK1tE3NoKzAptdjI+pq
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
ystems: XXXXXXXXXXXXXXXXXXXXXXXXXXX
FileDescription: Penguin Party Screen Saver - Shareware Versi
FileVersion: 
CompanyName: RI Soft Systems

Win32/Adware.WhenUSave also known as:

How to remove Win32/Adware.WhenUSave?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.