Hi, I'm new to the forum and the Internet and was looking for a bit of help. I can't remove WhenU.Save. It doesn't show up on Ad-Aware or Norton, but it's there on Windows Defender. When I try and delete I get a message saying 'Defender encountered problems, remove failed'. I can't find the program anywhere on the computer. I very well may be being thick here so all help is appreciated. I'm pulling my hair out.

Cheers.

WhenU.Save is a nasty adware that is heavily nested in ur PC...

Try this:

Search your computer for these Excecutable Files:

profilepath+\local settings\temp\savedisclosure.exe

programfilesdir+\save\save.exe

programfilesdir+\save\saveuninst.exe

wu.exe

vvsni_savenowsiteinst.exe

uninst.exe

sync.exe

searchupgrader.exe

search.exe

saveupdate.exe

savecms.exe

Autorun References:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run whenusave

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run whenusave

Registry Items:

HKEY_CLASSES_ROOT\wusn.1

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run whenusave

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run whenusave

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\whenusavemsg

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\whenusavepbtb

HKEY_LOCAL_MACHINE\software\whenusave

HKEY_LOCAL_MACHINE\software\whenusave zip

Files:

learn more about whenu save.url

save.cch

save.db

save.exe

save.htm

programfilesdir+\save\save.exe

programfilesdir+\save\save.htm

programfilesdir+\save\saveuninst.exe

programfilesdir+\save\store.db

wu.exe

commonprograms+\whenu\learn more about whenu save.url

profilepath+\local settings\temp\savedisclosure.exe

programfilesdir+\save\acm.dll

programfilesdir+\save\readme.txt

programfilesdir+\save\save.cch

programfilesdir+\save\save.db

savecms.exe

savedisclosure.exe

saveuninst.exe

saveupdate.exe

search.db

search.exe

searchupgrader.exe

sync.exe

uninst.exe

vvsni_savenowsiteinst.exe

whenusave.txt

And Directories:

%program_files%\save

commonprograms+\whenu

-----------------

When all this is removed you should get rid of WhenU.Save adware..

Hi dares, thanks for posting.

First, read this post that will help you clean your computer and remove the malware you speak of. After running all of the steps exactly as the guide has, post your HijackThis log and we'll get your system cleaned up.

Tarun

XP refused to remove the files, so I booted into DOS, and deleted those files that I could find. Subsequent reboot of Windows, despite not removing Registry entries, was fine.