Zango Search Assistant

Overview

Zango Search Assistant is a software component that opens new browser windows showing websites based on the websites you visit.

The vendor's statement about advertising: "Display of Advertising. The Software will run in the background on your computer and will periodically direct you to our sponsors' websites, allowing you to compare prices between websites. While the Software is installed on your computer, Zango may collect information about you and the websites you visit. This information will be used to provide you with comparative shopping opportunities when they are most relevant. By installing and/or using the Software you grant permission for Zango to periodically display sponsors' websites to you. The frequency of these advertisements will vary depending on your use of the Internet. You acknowledge that the Software includes an anonymous user ID and an electronic cookie that enables Zango to display this targeted advertising to you.

[snip]

Identification of Advertisements. The advertisements that the Software presents are provided in a separate browser window and are not endorsed by or affiliated with the websites that trigger their appearance. You can identify the origin of these advertisements by reviewing the web address in the address bar of the advertisement. Advertisements that the Software presents will also usually be branded with the Zango name and identifiable by the title 'Brought to you by Zango' (or similar language) in the title bar of your browser window." Source

The vendor's statement about the frequency of the advertisements: "Zango shows on average 2 to 3 websites daily based on the user's browsing activity." A company representative gives the same statement in a forum discussion: "We show, on average, 2-3 ads per day to our users, which is completely reasonable if you are in the shopping mood online. [snip] Our software works off of any search engine. If someone were to search for SportsFanFare it is entirely possible for one of our campaigns to come up in a brand new browser session if that is one of the keywords loaded into our system."

The advertisements are loaded in a new browser window and can in most cases be identified by the title mentioning Zango. Statement from a company representative: "Regarding the labeling of windows which we present our ads in, as stated above, the initial window is labeled. With regards to re-directs that is a known issue, though in most cases we have no control over re-directs as they are provided by our advertisers. This issue impacts less then 4% of the impressions we deliver."

Another company representative's statement about labelling of the new browser window: "For example, if you have Zango installed on your computer and you are searching Google for Las Vegas hotels, and your search returns a listing of hotels, a window might pop up displaying the Web site for Mandalay Bay, (this is only an example) at the top of this window you would see: "Brought to you by the Zango Search Assistant" to inform you of where the offer is coming from."

In Benjamin Edelman's article The Effect of 180solutions on Affiliate Commissions and Merchants he explains why Zango may pop-up a second browser window of merchants' sites.

The vendor's statement about updates: "The Software will check with Zango for the existence of any bug fix or Update that Zango has released, and in the event that one is available, the Software will update itself automatically" Source

Zango Search Assistant is bundled with Zango Messenger, Zango Muncher, Zango TV, Zango Showtimes, David vs. Goliath and Library of the Ages.

PestPatrol detects Zango Search Assistant as DyFuCA.Internet Optimizer [1] [2] (PestPatrol updated 2004-08-25 and 2004-09-23). According to a forum discussion at CNet Ad-Aware, Spybot and McAfee 8 have detected Zango Search Assistant. Spy Sweeper has detected Zango Search Assistant since May 31, 2004, according to Webroot's Spyware News. Ad-Aware detects Zango with Reference file 01R338 19.08.2004 and 01R341 14.09.2004.

There are a few articles about Zango Search Assistant: New wave of Web ads on the way Pop-up goes the commission 180solutions answers pop-up charges.

Update 2005-03-15: Zango 6,6,0,4 uses an icon in the system tray which will make it more obvious that Zango is running on the user's system.

Update 2005-03-30: Zango 6.7.0.8 uses the filename zanu.exe and installs in 'C:\Program Files\ZangoClient\'. This version adds the following registry key: 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run \ zanu'. The Zango installer located at http://downloads.zango.com/zangoInstaller/4216/ZangoInstaller.exe does not show Zango's EULA. However, if the the installer download is launched through http://www.zango.com/getzango/ you will get the following message before the download starts: "Clicking the OK button means you have accepted the terms of the End User License Agreement.". Bazooka does not detect this version of Zango.

Update 2005-04-01: When I out of curiosity decided to try one of the games offered by Zango I noticed a suprising behaviour: I started off at Zango.com, where a game called Strategery was advertised. I clicked the "Download Now »" link and entered the Strategery web page, where there was a big "play now!" link and below that links to the Zango Search Assistant EULA, faq, etc.
When clicking the "play now!" link a file download dialog appeared with a file called ZangoInstaller.exe. Based on my previous testing of Zango Search Assistant I have seen files named ZangoInstaller.exe install Zango Search Assistant, not games, so I am a little confused. Considering that I clicked the Strategery "Download Now »" link, then the 'Play Now' link and that no new web page is displayed in the web browser I reconsidered and assumed that the game would be installed with the ZangoInstaller.exe file. However, this assumption was wrong, ZangoInstaller.exe installed Zango Search Assistant only. It is not unlikely that some users may leave the zango.com web page, irritated because they only got the advertising software but no game.

Update 2005-04-07: The behaviour observed above remained so I decided to capture a video and notify one of 180solutions' representatives. Looking more in detail it appears to be a bug in the Javascript code used at the Zango game pages which cause this problem. The following games are affected: Vortex, Brix & Bomz, Bubble Burst, Attack of the Monster Robots!, Germoids, Sushi-Who, Banana Belt Blackjack, Killing Time Solitaire, Lucky Devil Video Poker, Pyramid Solitaire, Breakneck Bingo, Lonely Joe Poker Solitaire, Ribbit Relay, Word Nerd, Match-o-Matic, Strategery, Jetset Mahjong, Total Sum, Tiki Trouble and Jade Shadow Mahjong.

Update 2005-04-11: Captured another video, which more clearly shows that it is not possible to access the Zango games with Mozilla Firefox 1.02 even though Zango Search Assistant is installed and running on the system.

Classification

Adware

Files

zango.exe, zango.log, zango_kyf.dat, zangoau.dat, zangodb.dat, zangohook.dll, ZangoInstaller.dll, ZangoInstaller.inf, ZangoLib.dll, ZangoInstaller.exe

If you have any of the files related to Zango Search Assistant on your system, please send them for additional analysis. Generally, I have only analysed a few versions for each software component listed at this web site. With your help I will be able to look at both old and more recent versions of the Zango Search Assistant software. Thank you very much for your time!

Alias

Zango [AdAware], Zango Search Assistant [Microsoft Antispyware], Adware.nCase [Dr.Web], AdWare.180Solutions, AdWare.180Solutions.e [Kaspersky Anti-Virus], PMS/180Solutions.A, PMS/180Solutions.A.2 [AntiVir], Win32:Trojan-gen, Win32:SrchAssist-2 [Avast], Adware.180Solutions.5.11, Adware.1088 [BitDefender], Trojan.Spy.Ncase-3 [ClamAV], ADWARE/NcAS, Adware/180Solutions [Fortinet], .Ncase180, .180solutions [mks_vir], W32/Ncase.C, W32/Ncase.F [Norman Virus Control]

Vendor

zango.com whois_cached whois
180solutions.com whois

Distribution

180solutions advertise Zango on other sites but all downloads are eventually handled through Zango.com.

End User License Agreement

2004-08-23
EULA at Zango.com

Privacy policy

2004-08-23
Privacy policy at Zango.com

Detection

Bazooka Adware and Spyware Scanner detects Zango Search Assistant. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall notice for Zango Search Assistant

Notice that removing Zango Search Assistant may cause the program that bundled it to not function as intended.

Uninstall procedure

Uninstall Zango Search Assistant from "Add/Remove Programs" in the Windows® Control Panel. The uninstaller crashed during my testing of the 5.11.3.0 version, but it seems like it removed all Zango files. The folder "%ProgramsDir%\Zango\" was not deleted which you can delete manually.

Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.

Observations during the uninstall procedure

When uninstalling Zango Search Assistant 5.11.3.0 you must be connected to the Internet. The following describes the steps that I had to go through to uninstall Zango Search Assistant (Build Date: 7:6:54 PM, 6/24/2004, File version: 5.11.3.0) while connected to the Internet. (Uninstalling while not connected locked up the Control Panel applet, mshta.exe).

1. I launch the "Add/Remove Programs" list, select 'Zango', and click Remove.
2. A dialog appears informing me that the computer must have an Internet connection to uninstall the software.
3. The computer is connected to the Internet, so I click 'OK'.
4. An Internet Explorer window opens that is bigger than the 800x600 screen.
5. In order to continue the uninstall, I have to resize the browser window, move it, and then scroll down to find the 'Continue Uninstall' button.
6. I click the 'Continue Uninstall' button and a new web page is loaded which resize the browser window putting the browser's right scroll bar outside the screen.
7. In order to continue the uninstall, I have to resize the browser window, move it, and then scroll down to find the 'Continue Uninstall' button.
8. I click 'Continue Uninstall' button and a new web page is loaded which resize the browser window putting the browser's right scroll bar outside the screen.
9. In order to continue the uninstall, I have to resize the browser window, move it, and then scroll down to find the 'Continue Uninstall' button.
10. A dialog appears, asking me if I would like to complete the removal.
11. I continue the uninstall procedure, and a dialog appears, informing me that the uninstall has completed.
12. I continue and now a Windows operating system dialog appears informing that a file related to the uninstaller crashed.

Although a file related to the uninstaller failed during my testing, it appears that all Zango files were removed. The folder "%ProgramsDir%\Zango\" was not deleted which you can delete manually.

Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.

Update 2004-09-23: Tested the uninstaller for Zango 5.12.13.0, Build Date: 11:23:8 PM, 8/3/2004 which did not crash, but it still required me to resize and move the browser window, as described above, in order to complete the uninstall.

Update 2005-03-15: Tested the uninstaller for Zango 6,6,0,4, Signed: 14/2/2005 which worked smoothly, only requiring a few clicks [1] [2] [3] , compared to the 12 steps in the older 5.11.3.0 version. This 6,6,0,4 version does not require an internet connection to complete the uninstall.

Uninstall Zango Search Assistant with FreeFixer

I'm working on a general purpose tool for removing unwanted software. The tool is called FreeFixer and can help you remove unwanted Browser Helper Objects, Internet Explorer toolbars and software that starts automatically when you reboot your computer, so it can offer some assistance while uninstalling Zango Search Assistant. The manual removal instructions listed below will help you to identify what to delete with FreeFixer.

Read more about FreeFixer.

Manual removal

Please follow the instructions below if you would like to remove Zango Search Assistant manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If Zango Search Assistant remains on your system after stepping through the removal instructions, please double-check by stepping through them again.

1. Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)
2. Browse to the key:
   'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
3. In the right pane, delete the value called 'zango', if it exists.
4. Exit the registry editor.
5. Restart your computer.
6. Start Windows Explorer and delete:
   %ProgramsDir%\Zango\
   %WinDir%\Downloaded Program Files\ZangoInstaller.dll
   %WinDir%\Downloaded Program Files\ZangoInstaller.inf
   %WinDir%\Downloaded Program Files\ZangoLib.dll
   Note: %ProgramsDir% is a variable (?). By default, this is C:\Program Files.
   Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).

Problems uninstalling? Click here.

I'm looking for your help!

Thank you for using my site, I hope you find it useful. I'm looking for help from all users, please read more.

Contact information for Zango Search Assistant's vendor

In order to provide correct, accurate and updated information about Zango Search Assistant I encourage the vendor to contact me if any part of this write-up needs a revision.