You're in: Panda Security > Home Users > security-info > about-malware > encyclopedia > overview
Active Scan. Scan your PC free
Panda Security Product Line 2012

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard

SaveNow

 
Threat LevelModerate threatDamageHighDistributionNot widespread

Effects 

SaveNow carries out the following actions:

  • It provides information about the weather forecast.
  • It displays advertising pop-up windows.

Infection strategy 

SaveNow creates the following files in the subfolder SAVE, which is in the Program files directory:

  • SAVE.EXE, SAVE.HTML, README.TXT and SAVEUNINST.EXE.

 

SaveNow creates the following entries in the Windows Registry:

  • HKEY_LOCAL_MACHINE\ Software\ WhenUSave
  • HKEY_CLASSES_ROOT\ WUSN.1

Means of transmission 

Spyware programs are usually included in free applications downloaded from the Internet. These programs are installed on the affected computer, sometimes without user consent, without warning users that these programs will collect user details.

SaveNow is usually included in third-party software, such as BearShare and other peer-to-peer (P2P) file sharing programs, RadLight Video Player, etc. It can also reach the computer by accessing certain web pages, which ask for confirmation to install an ActiveX control.

Further Details  

SaveNow is written in the programming language Visual C++ v6.0 and it is 281,088 bytes in size.