Classification

Category :

Spyware

Type :

Adware

Aliases :

WhenU, WhenU

Summary

WhenU is an ad-delivery software vendor. In order for WhenU's software to display targeted and relevant advertisements it monitors the user's surfing habits. WhenU is different from other vendors by not sending back the collected data to WhenU's servers. The selection of advertisement is done locally on the end users system. Information why a selection was made is however included in the request for the advertisement. Pop-up advertisements are displayed on the user's system with content matched against the local database. The advertisement is commonly shown while browsing the web.

Removal

Based on the settings of your F-Secure security product, it may block the file from running, move it to the quarantine where it cannot spread or cause harm, or ask you to select an action.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

WhenU has several versions of ad-delivery software, that all are based on the same technology. During runtime, the ad-delivery software automatically fetches a local database consisting of combinations of criteria to select advertisements. WhenU's ad-delivery software monitors the browser habits in forms of visited URL, search queries and the content of the viewed web pages. Based on the browser information WhenU's ad-delivery software looks up in the local database and selects which advertisement to show. The ad-delivery software includes which data that generated that hit with the result and send it to WhenU's servers as a request for the advertisement. If a user clicks on a coupon it is reported back to WhenU's servers. Installing WhenU ad-delivery software will generate a unique machine ID to track the number of installations. If an application was installed bundled, an affiliate ID will also show which product it was bundled with. In the communication with WhenU servers, the affiliate ID is included and the unique machine ID excluded. The three most common products are SearchBar, SaveNow and Save.

SearchBar

WhenU's SearchBar is a toolbar hooked on to the desktop. Desktop SearchBar displays contextual ads and offers in the form of rotating text links accessible from within the application. Using the SearchBar will direct to search results monitored by the search provider.

SaveNow

WhenU's SaveNow runs in the background with a small tray icon visible. Advertisement are shown as pop-ups while browsing the web. Normally the advisement is a coupon to get discount for a 3rd party product.

Save

WhenU's Save behaves exactly like SaveNow. The only difference is that Save is bundled with free software to generate profit for the free software vendor.