The following instructions have been created to help you to get rid of "WhenU.Search.BrowserToolBar" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.

If this guide was helpful to you, please consider donating towards this site.

Threat Details:

  • adware

like WhenU.Search.DesktopToolbar, this connects right after installation to the internet using search.exe , which connects every 63 seconds.
it is also registered in Systemstart. it connects to server from whenU
the toolbar appears in IE and connects to a server from whenu every 63 seconds. --> search.exe gets started with the Toolbar
using the searchfunction starts search.exe if it has been deactivated.

search.exe does not close , when IE closes. --> it continues to establish connection to , intervals can vary between 60-63seconds
Supposed Functionality:
The WhenUSearch Browser Toolbar provides immediate access to powerful Internet search capabilities, while delivering contextually relevant text-based offers, discounts, and coupons.

Unlike traditional search toolbars, WhenU's unique contextual slider continuously presents you with non-intrusive text-links embedded within the browser toolbar as you continue to navigate the Internet.
Privacy Statement:
By downloading the WhenUSearch Toolbar ("the Toolbar"), you give permission to, Inc. ("WhenU") to display relevant contextual information and offers. The Toolbar selects which ads and offers to show you based on several factors, including: which webpages you visit, search terms you use while searching online, your local zip and/or country code, and content of the webpages you view. The Toolbar displays contextual ads and offers in the form of rotating text links accessible from within the application.

The Toolbar protects your privacy by uploading a database of content in small chunks to your desktop and then determining on your desktop whether to retrieve information from WhenU or third-party servers. To protect your privacy, the same database of content is sent to all desktops. Decisions regarding which advertising and offers to retrieve are processed on your computer desktop. In this way, WhenU is able to deliver to you relevant coupons, information and advertisements without establishing any profile about you (even anonymously) on WhenU servers.

Your privacy is also protected in the following manner:

1) Your personally-identifiable information is not required in order to use the Toolbar. WhenU does not know your individual identity and does not attempt to discern it in any way.

2) As you surf the Internet, your "clickstream data" (i.e. a log of all the sites you visit) is not transmitted to WhenU or any third party server. (Although impressions and click-throughs that contain indicia of browsing activity are transmitted each time an ad is served, as described below, these communications are never linked to personally identifiable information and are otherwise carefully designed to protect your privacy.)

3) WhenU does not assemble any personally-identifiable browsing profiles of you or your individual machine.

4) WhenU does not assemble any anonymous machine-identifiable browsing profile of you or your machine.

5) WhenU does not track which ads and offers you see as an individual user all of our analysis and tracking of ads is done in the aggregate.

The Toolbar does send back certain information from your desktop in order to count the number of users in our network and optimize the performance and relevancy of the ads. For example, when an offer is displayed to you in the Toolbar and whenever you click on such an offer, the Toolbar sends WhenU a communication that may include information about the webpage you were viewing before you saw or clicked on a particular ad. WhenU has intentionally designed these communications back to WhenU to be highly protective of user privacy, in the following ways:

(a) Each individual desktop is assigned an anonymous, unique machine ID. This machine ID is used only to enable WhenU to count unique, active desktops in the network. The machine ID is not used to determine which ads to serve individual users or to create browsing profiles of users.

(b) When ads are requested and/or displayed by the Toolbar, impressions and click-throughs, including the factor (e.g., the URL, the keyword, or the search term, or some combination thereof) that caused the ad to be displayed are reported to WhenU. Because the Toolbar's advanced functionality is designed to display ads whenever contextually-relevant activity is detected, a continuous series of impressions and click-throughs may be transmitted to's servers as you surf the Internet. To protect your privacy and prevent WhenU or any third party from assembling individual user profiles or knowing which Web sites you visit, your unique machine ID is intentionally excluded from any communications sent back to WhenU that may include a URL or such other browsing-specific information.

The Toolbar does not place any cookies on your desktop. It is possible that a third party advertising on our network might place a cookie on your desktop. If you wish to opt-out from third party cookies, please click on the following link and follow the instructions: may update this privacy statement at any time. WhenU is committed to serving highly relevant, contextual coupons and offers, while still providing consumers with industry-leading privacy protection. More information about the software is available here, or for any further questions about our privacy policy please email
Removal Instructions:

Installed Software List:

You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D or RunAlyzer to locate and get rid of these entries.
  • Products that have a key or property named "WhenUSearchB".


Please use Windows Explorer or another file manager of your choice to locate and delete these files.
  • A file with an unknown location named "VVSN_WHSB0104Inst.exe".
Make sure you set your file manager to display hidden and system files. If WhenU.Search.BrowserToolBar uses rootkit technologies, use our RootAlyzer or our Total Commander anti-rootkit plugins.
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!


You can use regedit.exe (included in Windows) to locate and delete these registry entries.
  • Delete the registry key "{45E5DADB-DFDF-4FC3-A46C-DD34B6CDDB38}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry key "{BA2325ED-F9EB-4830-8FCE-0BC35B16969B}" at "HKEY_CLASSES_ROOT\CLSID\".
  • Delete the registry value "{45E5DADB-DFDF-4FC3-A46C-DD34B6CDDB38}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\".
  • Delete the registry key "{BA2325ED-F9EB-4830-8FCE-0BC35B16969B}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
  • Delete the registry value "{45E5DADB-DFDF-4FC3-A46C-DD34B6CDDB38}" at "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\".
If WhenU.Search.BrowserToolBar uses rootkit technologies, use our RegAlyzer, RootAlyzer or our Total Commander anti-rootkit plugins.

Final Words:

If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
  1. Please read these instructions before requesting assistance,
  2. Then start your own thread in the Malware Removal Forum where a volunteer analyst will advise you as soon as available.