Zango spyware - Free Antivirus Forum

Zango spyware

BullGuard Antivirus Forum > General Security > Spyware > Zango spyware

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Amatoren
New Member

Date Joined Sep 2005
Total Posts : 2

Posted 9-17-2005 11:03 (GMT +2)

We have reciept Zango spyware.

I found 68 hits with Ad-Aware SE Personal, which has ben removed, so I dont find any hits now.

I then run Norton Antivirus and found 6 hits, and have removed 5 of them.

I still find af treat called RCX9F.tmp with the name Adware.180solution placed on C:>Windows\Downloaded Progran Files, but I cannot find it there - even not as a hidden file - I wil be happy, if someone can help mee, please :-)

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13069

Posted 9-18-2005 7:28 (GMT +2)

Hey Amatoren cool

Please follow these steps:

http://www.magicnet.dk/Preparation.doc

Regards - Touch

antispy
Junior Member

Date Joined May 2005
Total Posts : 93

Posted 9-18-2005 10:44 (GMT +2)

Amatoren,

here is zango spyware removal instructions: zango removal

spyware removal

Amatoren
New Member

Date Joined Sep 2005
Total Posts : 2

Posted 10-3-2005 12:31 (GMT +2)

Step one:Clean 4.0 did take away the virus, and since theird time I restarted the PC after that it was as normal.

I then did run Ad-aware SE which I have used a lot lately, and in a full systemscan I this time found 2 hits - I normally find (and delete) 4 hits (IEcache entry).

Step Two: Viruses/Trojans Ewido Security Suite I found:

ewido security suite - Scanningsrapport

---------------------------------------------------------

+ Oprettet den: 23:11:17, 02-10-2005

+ Rapport-Checksum: B0A77E97

+ Scanningsresultat:

HKLM\SOFTWARE\Classes\CLSID\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Renset med backup

HKLM\SOFTWARE\Classes\GSDA.GSDACtl\CLSID\\ -> Spyware.GameSpyArcade : Renset med backup

HKLM\SOFTWARE\Classes\GSDA.GSDACtl.1\CLSID\\ -> Spyware.GameSpyArcade : Renset med backup

HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Renset med backup

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/gsda.dll\\.Owner -> Spyware.GameSpyArcade : Renset med backup

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/gsda.dll\\{70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -> Spyware.GameSpyArcade : Renset med backup

C:\Documents and Settings\Peter\Cookies\peter@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Renset med backup

C:\Programmer\Tiscali\Tiscali Internet\dlls\InstallDialer.exe/Dialer.exe -> Heuristic.Win32.Dialer : Fejl under renselse

C:\WINDOWS\Downloaded Program Files\gsda.dll -> Dialer.Generic : Renset med backup

::Rapport !!!!

Next step: DrWebcureit found 4 hits -

2 x probablyh STPAGE.Trojan and

2 x probable DLOADER.Trojan

Finaly, the Hijack log says:

Logfile of HijackThis v1.99.1

Scan saved at 00:04:16, on 03-10-2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\drivers\CDAC11BA.EXE

C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe

C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Programmer\Intel\Intel Application Accelerator\iaantmon.exe

C:\Programmer\Norton Internet Security\ISSVC.exe

C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe

C:\Programmer\Intel\Intel Application Accelerator\iaanotif.exe

C:\Programmer\Dell\Media Experience\PCMService.exe

C:\Programmer\r\CyberLink\PowerDVD\DVDLauncher.exe

C:\Programmer\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

C:\Programmer\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe

C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE

C:\Programmer\Logitech\MouseWare\system\em_exec.exe

C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe

C:\Programmer\InterVideo\WinDVR\WinScheduler.exe

C:\Programmer\Internet Explorer\iexplore.exe

C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NSMdtr.exe

C:\Programmer\ewido\security suite\ewidoguard.exe

C:\Programmer\ewido\security suite\ewidoctrl.exe

C:\Programmer\ewido\security suite\SecuritySuite.exe

C:\Documents and Settings\Peter\Lokale indstillinger\Temporary Internet Files\Content.IE5\QP9I3A9C\drweb-cureit[1].exe

C:\DOCUME~1\Peter\LOKALE~1\Temp\RarSFX0\drw_start.exe

C:\DOCUME~1\Peter\LOKALE~1\Temp\RarSFX0\drweb32w.exe

C:\Programmer\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Programmer\Messenger\msmsgs.exe

C:\Program Files\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programmer\Fælles filer\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\j2re1.4.2_03\bin\jusched.exe

O4 - HKLM\..\Run: [IAAnotif] C:\Programmer\Intel\Intel Application Accelerator\iaanotif.exe

O4 - HKLM\..\Run: [PCMService] "C:\Programmer\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [DVDLauncher] "C:\Programmer\r\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Programmer\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

O4 - HKLM\..\Run: [CTDVDDet] C:\Programmer\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [UpdateManager] "C:\Programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programmer\TerraTec\Cinergy 400 TV\TTTVRC.exe

O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\SetIcon.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet

O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG

O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programmer\InterVideo\Common\Bin\WinCinemaMgr.exe

O4 - Global Startup: InterVideo WinScheduler.lnk = C:\Programmer\InterVideo\WinDVR\WinScheduler.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\j2re1.4.2_03\bin\npjpi142_03.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\INETREPL.DLL

O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe

O15 - Trusted Zone: *.danskebank.dk

O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab

O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab

O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://quickplace.wmdata.dk/qp2.cab

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095111858000

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/install/guidedsolutions.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab

O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab

O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe

O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Programmer\Intel\Intel Application Accelerator\iaantmon.exe

O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programmer\Norton Internet Security\ISSVC.exe

O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FÆLLES~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

I have reciept an advise to try Spy Sweeper, but did find nothing with it.

So .... I would be happy to know what to do now :-)

as I am a litle afraid til use my PC as it seemes to have som problems.

The program Ewido Security Suite found 10 hits and I wonder if it would be a great idea to by it?

max_m
New Member

Date Joined Oct 2006
Total Posts : 1

Posted 10-5-2006 11:18 (GMT +2)

haha very funny thing just happened, after removing 182 rices of zango spyware from my comp using xoftspy (very good program btw) i emailed zango with a very heavy letter complaining about their software with "rather rude language" shall we say, and this is how they replied:

Hello,

Thank you for taking interest in Zango. As you know, Zango is a new way to access free programs and tools to make life a little easier and lots more fun. With Zango, you get to play free games, download valuable programs and enjoy some of the most interesting sites on the web.

There are no fees, no subscriptions and no trial periods - with Zango everything is always completely free and safe!

To use Zango, go to http://www.zango.com/getzango/ and download Zango. It should take less than a minute and once Zango is downloaded you will have free access to all the content on our website, along with affiliate sites. Downloading Zango will not put the programs onto your computer, rather once Zango has been downloaded, go to the program that you would like, and download it from there.

If you have any more questions, feel free to respond to this e-mail or you can call us at 1-800-409-2285. Thank you very much.

Zango Support

so, laughing my head off, this is how i replied:

AHAHAHAHAHA wait a minute wait a minute... did i just read the word SAFE? SAFE? SAFE?!! HA! I scanned xoftspy and found 182 peices of spyware, half of which were classified, (and i quote) "Severe risk"! and you have the stupidity to say it is safe? ahahaha well ill thank you for one thing: a good laugh!

AND FURTHER STILL , AFTER TELLING YOU THAT I KNOW IT IS SPYWARE, YOU GIVE ME THE DOWNLOAD LINK!?!? HAHA OMG YOU NOT THE BRIGHTEST BUTTONS ARE YOU

ahhhh that was a good laugh. Thank you zango! (lol :P)

chuckd
New Member

Date Joined Jan 2008
Total Posts : 2

Posted 1-12-2008 2:53 (GMT +2)

Hey all I'm just coping what I posted in a similar topic.

If you are still having problems removing zango, I found this blog that helped me out. All the best!!
zangoremoval.blogspot.com/2007/11/zango-removal_4120.html

Antispywr
New Member

Date Joined May 2008
Total Posts : 1

Posted 5-31-2008 11:49 (GMT +2)

Zango IS spyware.

They are also liars.

I looked on the Zango FAQ, and it said:

Is Zango Spyware?

Absolutely not! Spyware invades your privacy … Zango respects it! The purpose of spyware is to secretly gather information about your computer usage and the sites that you visit so it can be sold to advertisers and others. Usually, spyware is hidden inside another program and downloaded without the user’s informed consent. Zango does not collect or share any information about you with anyone. Caution: Spyware has the ability to record your keystrokes, passwords and credit card numbers, scan your hard drive, eavesdrop while you chat, collect your cookies, change your toolbars and default settings, and continuously transmit your information back to its database.

On the Zango Terms and Agreements, it said:

Notice for All Users:

By installing the Zango Software, you get free access to sponsored content available on the Internet and other software applications. The Zango Software will show you a limited number of ads that pop up on your screen in a separate browser and/or in a Slider format similar to an Instant Messaging notification. The ads are based on keywords from the websites you visit. Please note that you may receive Adult-oriented ads if you utilize keywords connected to, search for or view Adult websites. See Section 7.2 below for more details. Once installed and running, you can access the Zango Software from your system tray, and you can uninstall it at any time by using the Add or Remove Programs feature of Microsoft Windows. Please see Section 3 below for important terms and conditions regarding other software applications distributed by Zango.

The stupid people at Zango.... They are truly !!!!! scammers....

Dragan
New Member

Date Joined Jun 2008
Total Posts : 10

Posted 7-13-2008 3:10 (GMT +2)

Hello guys.

Zango virus is less then any virus problem.
Zango virus is bundled with games,music,applications,etc...
U probably installed game called 'David vs Goliath' which is bundled with zango virus or mb some other game or music and u got that virus.
But as they replied...by getting that virus into ur pc u are able to play their games listen,to music and other things.
Now try to remember which game u installed when u got zango virus,just uninstall the game and he will stop working.
I mean on zango which u cannot delete...just uninstall the game or delete music file u downloaded or w/e...

Forum Information

Currently it is Monday, October 06, 2008 5:11 PM (GMT +2)
There are a total of 62.544 posts in 15.603 threads.
In the last 3 days there were 20 new threads and 43 reply posts. View Active Threads