{
  "family": "whenu",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nWhenU (most famous for its \"SaveNow\" application) is one of the original, pioneering families of Adware. Highly prevalent in the early 2000s, WhenU established many of the deceptive bundling and behavioral tracking techniques still utilized by modern Potentially Unwanted Programs (PUPs). It was designed to monitor a user's web browsing in real-time to deliver highly targeted, contextual pop-up advertisements.\n\n<h3>Distribution and Technical Behavior</h3>\nWhenU was almost exclusively distributed via aggressive software bundling. It was famously packaged with early, highly popular peer-to-peer (P2P) file-sharing applications (like BearShare and Kazaa), meaning users inadvertently installed the adware when seeking out legitimate software.\n\nOnce executed, WhenU integrated deeply into the user's browsing experience:\n<ul>\n<li><strong>Contextual Ad Delivery:</strong> The core component of WhenU (SaveNow) actively monitored the URLs a user visited and the search terms they entered into search engines. If a user searched for \"flights to London,\" WhenU would instantly generate a pop-up advertisement for a competing travel agency.</li>\n<li><strong>Local Database and Updates:</strong> Rather than querying a server for every ad, WhenU downloaded a massive, encrypted database of keywords and corresponding affiliate links to the local hard drive. This allowed it to serve ads instantly without generating massive amounts of network traffic, hiding its operations from early firewalls.</li>\n<li><strong>Deceptive EULA:</strong> WhenU was notorious for its End User License Agreement (EULA), which buried the details of its tracking and ad-serving behaviors deep within pages of legal jargon, allowing the company to claim users had \"consented\" to the adware.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nWhile WhenU argued it was legitimate marketing software (and fought numerous legal battles regarding the definition of spyware), it was universally classified as Adware by security vendors. It caused immense system slowdowns, generated highly disruptive pop-ups, and represented a significant invasion of user privacy by tracking all web activity.\n\n<h3>Mitigation and Removal Strategies</h3>\n<ul>\n<li><strong>Endpoint Scanning:</strong> Modern enterprise-grade anti-malware solutions easily detect and remove WhenU and its associated components. A full system scan will identify the executables and the local ad databases.</li>\n<li><strong>Application Control:</strong> The primary defense against adware like WhenU is enforcing strict application whitelisting policies, preventing standard users from executing unapproved software installers (especially P2P clients) that serve as the distribution vector.</li>\n<li><strong>Legacy Systems:</strong> While WhenU is largely extinct on modern OS architectures, legacy systems (Windows XP/7) used in specific OT environments should be scanned to ensure these classic adware families are not silently consuming resources.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.WhenU",
    "PUP.SaveNow",
    "Adware.WhenUSave"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1566.002",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:04:40Z",
  "type": "Classic Adware",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}