WhenU.VVSN is an adware program with spyware capabilities.  It installs itself on your computer without your consent and without an end user license agreement (EULA).  When it is installed on your computer, it searches through your temporary Internet files to find browsing information, ostensibly to deliver customized ads to you while you’re browsing.  It delivers advertisements in the form of pop-ups.

Between the pop-up delivery, the file searching, and communication with a remote host, WhenU.VVSN takes a large portion of your computer’s resources.  It can slow down computer performance, cause computer errors and compromises your privacy by sharing your information with a remote server.  It is recommended that you remove it from your computer.

You may have been infected with WhenU.VVSN by unsafe browsing practices.  These include, but aren’t limited to, viewing dubious web pages and content, downloading pirated, freeware, or shareware media and software.

SpyZooka can easily remove WhenU.VVSN and its variants.

Also Known As:

Adware/SaveNow,

not-a-virus:WebToolbar.Win32.WhenU.a,

not-a-virus:AdWare.Win32.SaveNow.bo,

BearShare

Associated Files:

autoupgrade41b3.exe, autoupgrade502b2.exe, minibugtransporter.dll, save.db, save.exe, save.htm, savei-syncm-whseinst.exe, saveuninst.exe, store.db, sync.exe, weather.exe-0e97dc24.pf, weather.exe-0f2f1a66.pf, weathercast.lnk, weathercast.txt, weatherinst.exe, weatherupdate.exe-06cd17e1.pf, wxbugsetup50b11.exe.
lfcmp10n.dll, lfimg10n.dll, ltdis10n.dll, ltfil10n.dll, ltkrn10n.dll in Program Files\aws\weathercast\
embedse.dll in Program Files\common files\whenu\
vvsn.exe in Program Files\vvsn\
uctlinst.exe in Program Files\vvsn\url3\
uninst.exe, weather.exe, weatherupdate.exe in Program Files\weathercast\
weather.exe in Program Files\weathe~1\
saveinst.inf, sndbmark.dll in Windows\downloaded program files\
sndbmark.dll in Windows\downloaded program files\conflict.1\
sndbmark.dll in Windows\downloaded program files\conflict.2\
sndbmark.dll in Windows\dowssnloaded program files\
sndbmark.dll in Windows\temp\icd1.tmp\

Registry Files:

minibugtransporter.dll.
lfcmp10n.dll, lfimg10n.dll, ltdis10n.dll, ltfil10n.dll, ltkrn10n.dll in Program Files\aws\weathercast\
embedse.dll in Program Files\common files\whenu\
sndbmark.dll in Windows\downloaded program files\
sndbmark.dll in Windows\downloaded program files\conflict.1\
sndbmark.dll in Windows\downloaded program files\conflict.2\
sndbmark.dll in Windows\dowssnloaded program files\
sndbmark.dll in Windows\temp\icd1.tmp\
Delete these registry entries
HKEY_CLASSES_ROOT\clsid\{fc327b3f-377b-4cb7-8b61-27cd69816bc}
HKEY_CLASSES_ROOT\clsid\{fc327b3f-377b-4cb7-8b61-27cd69816bc3}
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\weathercast
HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{fc327b3f-377b-4cb7-8b61-27cd69816bc3}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/sndbmark.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\vvsn
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls\c:\windows\downloaded program files\sndbmark.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\displayicon
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\displayversion
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\helplink
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\publisher
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\uninstallstring
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\weathercast\urlinfoabout
HKEY_USERS\.default\software\microsoft\windows\currentversion\run\weathercast