Spyware Detail

Zango Search Assistant

Date Published:
Monday, August 16, 2004

Threat Assessment

Overall Risk: Very Low

Privacy: Very Low

Productivity: Very Low

System Integrity:

Characteristics

Category : Adware

Immediate Protection Info

DAT Release	Product	DAT Version
Original	eTrust PestPatrol v4 eTrust PestPatrol v5 eTrust PestPatrol v8 CA Antispyware v9	05 05 2005 05 05 2005 05 05 2005 05 05 2005
Latest	eTrust PestPatrol v4 eTrust PestPatrol v5 eTrust PestPatrol v8 CA Antispyware v9	12 29 2006 12 04 2008 12 04 2008 12 31 2008

Tools

Scan for Spyware

Submit a Sample

Description
Origins
Operation
Removal
Research

Description

Category

Adware: Software that displays pop-up/pop-under advertisements when the primary user interface is not visible, or which do not appear to be associated with the product.

Reasons For Retention

Based on eTrust Anti-Spyware Scorecard v3.0 on the 23rd of January 2007.
Zango Search Assistant violates criteria 11 which states:
Updates itself or any other item without clear notice to the user and obtaining user permission at time of update.

Origins

Author

180Solutions Inc

Others By This Author

180Solutions.Seekmo
Zango TV Times 2.1.0.1
Seekmo B
180Solutions.Zango
180Solutions
MediaGateway
NCase
Zango Toolbar 4.8.3.3307
180SearchAssistant
Zango Astrology
Zango Walls of Jericho 2.1.0.1
Zango Search Assistant 8.70.32.0
Zango Toolbar
Zango Toolbar 4.8.2.3209
Zango Search Assistant 8.50.167.0

Date of Origin

date of origin: April, 2005

Operation

Zango Search Assistant: at least Zango Search AssistantKB

Removal

Detections:

true

Executable Files:

true

Autorun References:

DLL Files:

Registry Items:

HKEY_LOCAL_MACHINE\software\zango\zango 
HKEY_LOCAL_MACHINE\software\zango\zango\install 
HKEY_LOCAL_MACHINE\software\zango\zango\machineinfo 
HKEY_LOCAL_MACHINE\software\zango\zango\pi 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run zangosa
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d} 
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d}\inprocserver32 
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d}\inprocserver32 threadingmodel
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d}\progid 
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d}\typelib 
HKEY_CLASSES_ROOT\clsid\{07aa283a-43d7-4cbe-a064-32a21112d94d}\versionindependentprogid 
HKEY_CLASSES_ROOT\clsid\{1e5b2693-d348-4ca7-8364-4f5e51bf9c6d} 
HKEY_CLASSES_ROOT\clsid\{2e54ac53-efa4-4831-a3f6-b47b1a1937cf} 
HKEY_CLASSES_ROOT\clsid\{54a3f8b7-228e-4ed8-895b-de832b2c3959} 
HKEY_CLASSES_ROOT\clsid\{5b2e150d-4c8a-40e4-8c36-dd9c02771c67} 
HKEY_CLASSES_ROOT\clsid\{627d894a-8a77-416e-b522-432eaf2c818e} 
HKEY_CLASSES_ROOT\clsid\{7138f250-5b72-48dd-adfb-9a83b429dd9e} 
HKEY_CLASSES_ROOT\clsid\{8971cb48-9fca-445a-be77-e8e8a4cc9df7} 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\inprocserver32 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\inprocserver32 threadingmodel
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\instance clsid
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\instance\initpropertybag url
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\miscstatus 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\miscstatus\1 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\progid 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\toolboxbitmap32 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\typelib 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\version 
HKEY_CLASSES_ROOT\clsid\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c}\versionindependentprogid 
HKEY_CLASSES_ROOT\clsid\{b0cb585f-3271-4e42-88d9-ae5c9330d554} 
HKEY_CLASSES_ROOT\clsid\{b88e4484-3ff6-4ea9-815b-a54fe20d4387} 
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\inprocserver32 
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\inprocserver32 threadingmodel
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\progid 
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\programmable 
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\typelib 
HKEY_CLASSES_ROOT\clsid\{ea0b6a1a-6a59-4a58-9c41-9966504898a5}\versionindependentprogid 
HKEY_CLASSES_ROOT\hbmain.commband.1 
HKEY_CLASSES_ROOT\hbmain.commband.1\clsid 
HKEY_CLASSES_ROOT\hbmain.commband\clsid 
HKEY_CLASSES_ROOT\hbmain.commband\curver 
HKEY_CLASSES_ROOT\hbr.hbmain.1 
HKEY_CLASSES_ROOT\hbr.hbmain.1\clsid 
HKEY_CLASSES_ROOT\hbr.hbmain\clsid 
HKEY_CLASSES_ROOT\hbr.hbmain\curver 
HKEY_CLASSES_ROOT\hostie.bho.1 
HKEY_CLASSES_ROOT\hostie.bho.1\clsid 
HKEY_CLASSES_ROOT\hostie.bho\clsid 
HKEY_CLASSES_ROOT\hostie.bho\curver 
HKEY_CLASSES_ROOT\interface\{00b77587-be1b-4201-b8e9-09fcf50ab771} 
HKEY_CLASSES_ROOT\interface\{00b77587-be1b-4201-b8e9-09fcf50ab771}\proxystubclsid 
HKEY_CLASSES_ROOT\interface\{00b77587-be1b-4201-b8e9-09fcf50ab771}\proxystubclsid32 
HKEY_CLASSES_ROOT\interface\{00b77587-be1b-4201-b8e9-09fcf50ab771}\typelib 
HKEY_CLASSES_ROOT\interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f} 
HKEY_CLASSES_ROOT\interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f}\proxystubclsid 
HKEY_CLASSES_ROOT\interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f}\proxystubclsid32 
HKEY_CLASSES_ROOT\interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f}\typelib 
HKEY_CLASSES_ROOT\interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b} 
HKEY_CLASSES_ROOT\interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b}\proxystubclsid 
HKEY_CLASSES_ROOT\interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b}\proxystubclsid32 
HKEY_CLASSES_ROOT\interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b}\typelib 
HKEY_CLASSES_ROOT\interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f} 
HKEY_CLASSES_ROOT\interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f}\proxystubclsid 
HKEY_CLASSES_ROOT\interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f}\proxystubclsid32 
HKEY_CLASSES_ROOT\interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f}\typelib 
HKEY_CLASSES_ROOT\srv.coreservices.1 
HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 
HKEY_CLASSES_ROOT\toolbar.toolbarctl 
HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 
HKEY_CLASSES_ROOT\typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4}\1.0 
HKEY_CLASSES_ROOT\typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4}\1.0\0 
HKEY_CLASSES_ROOT\typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4}\1.0\0\win32 
HKEY_CLASSES_ROOT\typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4}\1.0\flags 
HKEY_CLASSES_ROOT\typelib\{087c4054-0a2b-4f35-b0db-bed3e21650f4}\1.0\helpdir 
HKEY_CLASSES_ROOT\zango.desktopflash.1 
HKEY_CLASSES_ROOT\zangoax.clientdetector.1 
HKEY_CLASSES_ROOT\zangoax.userprofiles.1 
HKEY_CLASSES_ROOT\zangoax.userprofiles.1\clsid 
HKEY_CLASSES_ROOT\zangoax.userprofiles\clsid 
HKEY_CURRENT_USER\software\microsoft\internet explorer\explorer bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} 
HKEY_CURRENT_USER\software\microsoft\internet explorer\explorer bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} barsize
HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser {07aa283a-43d7-4cbe-a064-32a21112d94d}
HKEY_CURRENT_USER\software\zango\common 
HKEY_CURRENT_USER\software\zango\hostol 
HKEY_CURRENT_USER\software\zango\time 
HKEY_CURRENT_USER\software\zango\time\hostie 
HKEY_CURRENT_USER\software\zango\zango 
HKEY_CURRENT_USER\software\zango\zango\imageshistory 
HKEY_CURRENT_USER\software\zango\zango\options 
HKEY_CURRENT_USER\software\zango\zango\pi 
HKEY_CURRENT_USER\software\zango\zango\pi\3.2 
HKEY_CURRENT_USER\software\zango\zango\sample 
HKEY_CURRENT_USER\software\zango\zango\sample\hist 
HKEY_CURRENT_USER\software\zango\zango\ueui 
HKEY_CURRENT_USER\software\zango\zango\userinfo 
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\explorer bars\{93b0fa7b-50f6-41b4-ac7e-612a72ce8c3c} 
HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar {07aa283a-43d7-4cbe-a064-32a21112d94d}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{07aa283a-43d7-4cbe-a064-32a21112d94d} 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run zangooe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run zangooe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run zangosa

Files:

1805d.exe
2924808
3022494
3046389
18057.exe
em2.exe
hostie.dll
install.dll
uninstall zango instructions.lnk
zango customer support.url
zango.exe
zango_gdf.dat
zango_kyf.dat
zangoau.dat
%profile%\application data\zango\v3.0\zango\static\download\buttondir.txt
%profile%\application data\zango\v3.0\zango\static\download\buttondir.xip
%profile%\application data\zango\v3.0\zango\static\download\layout.cdf
%profile%\application data\zango\v3.0\zango\static\download\layout.xip
%profile%\application data\zango\v3.0\zango\static\download\linkpathlegal.txt
%profile%\application data\zango\v3.0\zango\static\download\linkpathlegal.xip
%profile%\application data\zango\v3.0\zango\static\download\samplegroups2.txt
%profile%\application data\zango\v3.0\zango\static\download\samplegroups2.xip
%program_files%\zango\bin\10.0.370.0\arrow.ico
%program_files%\zango\bin\10.0.370.0\copyright.txt
%windows%\fmlotez.exe
%program_files%\zango\bin\10.0.370.0\coresrv.dll
%program_files%\zango\bin\10.0.370.0\firefox\extensions\components\npclntax.xpt
%program_files%\zango\bin\10.0.370.0\firefox\extensions\install.rdf
%program_files%\zango\bin\10.0.370.0\firefox\extensions\plugins\npclntax_zangosa.dll
%program_files%\zango\bin\10.0.370.0\hostie.dll
%program_files%\zango\bin\10.0.370.0\hostoe.dll
%program_files%\zango\bin\10.0.370.0\hostol.dll
%program_files%\zango\bin\10.0.370.0\instie.dll
%program_files%\zango\bin\10.0.370.0\link.ico
%program_files%\zango\bin\10.0.370.0\oeaddon.exe
%program_files%\zango\bin\10.0.370.0\srv.exe
%program_files%\zango\bin\10.0.370.0\toolbar.dll
%program_files%\zango\bin\10.0.370.0\wallpaper.dll
%program_files%\zango\bin\10.0.370.0\zangosa.exe
%program_files%\zango\bin\10.0.370.0\zangosaax.dll
%program_files%\zango\bin\10.0.370.0\zangosadf.exe
%program_files%\zango\bin\10.0.370.0\zangosahook.dll
%program_files%\zango\bin\10.0.370.0\zangouninstaller.exe
%program_files%\zango\bin\10.0.370.0\zangosahook.dll
%program_files%\zango\bin\10.0.370.0\zangosaax.dll
%program_files%\zango\bin\10.0.370.0\wallpaper.dll
%program_files%\zango\bin\10.0.370.0\toolbar.dll
%program_files%\zango\bin\10.0.370.0\instie.dll
%program_files%\zango\bin\10.0.370.0\hostol.dll
%program_files%\zango\bin\10.0.370.0\hostoe.dll
%program_files%\zango\bin\10.0.370.0\hostie.dll
%program_files%\zango\bin\10.0.370.0\firefox\extensions\plugins\npclntax_zangosa.dll
%program_files%\zango\bin\10.0.370.0\coresrv.dll
install.dll
1805d.exe
zango.exe
em2.exe
18057.exe
%program_files%\zango\bin\10.0.370.0\srv.exe
%program_files%\zango\bin\10.0.370.0\oeaddon.exe
%program_files%\zango\bin\10.0.370.0\zangosa.exe
%program_files%\zango\bin\10.0.370.0\zangosadf.exe
%windows%\fmlotez.exe
%program_files%\zango\bin\10.0.370.0\zangouninstaller.exe

Directories:

File Analysis

Zango Search Assistant