GreenguyandJim Fighting Zango

[babymaker]

Originally Posted by zman

Hey babymaker,

What's wrong with the remover I wrote? It's not a program, just a batch file, but it does the job and it does not delete all your cookies only the ones created by the zango toolbar.

yea, that's great! forgot about that, been busy.

[heywood]

Originally Posted by zman

Hey babymaker,

What's wrong with the remover I wrote? It's not a program, just a batch file, but it does the job and it does not delete all your cookies only the ones created by the zango toolbar.

Is there any way I can get that file, or a list of the cookies it uses? I'd like to add that into my program as well.

[zman]

Originally Posted by heywood

Is there any way I can get that file, or a list of the cookies it uses? I'd like to add that into my program as well.

It's attached to my post on the previous page of this thread.

[heywood]

Originally Posted by zman

It's attached to my post on the previous page of this thread.

Awesome, thanks man!

Its nice to see a lot of us banding together on this effort, it helps everyone in the long run (well everyone except scumware companies).

[Jim]

Thanks guys
I should be near 100% on Monday...or close to it. As I mentioned the past few days, I am really sick. I will get in touch with both of you about adding them to adwaresucks.com
We have seemed to have caught the medias attention. I received an email from a mainstream scumware fighting site asking for an interview and a few others.

We are going to have to come up with something easily editable where we can add new programs as they surface. Cookie stuffing is the worst thing we will see happen and it is coming on us like a train. Imagine, someone with this software installed will click on a ccbill link and someone else will be credited with the sale. And nobody will see this happening.

[tickler]

Originally Posted by Jim

Cookie stuffing is the worst thing we will see happen and it is coming on us like a train. Imagine, someone with this software installed will click on a ccbill link and someone else will be credited with the sale. And nobody will see this happening.

Do you think maybe you could drag ccBill, and some of these sponsors out to explain what they are doing to fix this.

I would like to see a list of sponsors that have made an effort to fight this theftware.

[MightyMidget]

Hey zman, nice script!
Haven't tried running it but I know that taskkill is not available for Windows XP *Home* Edition (and probably not for Windows versions before that either). Which means it won't work for most surfers and they'll end up getting a "not a valid Win32 program" - message.

pskill might be an option though it means you'd have to include it in the zip
http://www.sysinternals.com/Utilities/PsKill.html

Also, you might wanna add the "/-p" parameter to your dir commands in case the user has the DIRCMD variable set.

[zman]

Hey zman, nice script!
Haven't tried running it but I know that taskkill is not available for Windows XP *Home* Edition (and probably not for Windows versions before that either). Which means it won't work for most surfers and they'll end up getting a "not a valid Win32 program" - message.

pskill might be an option though it means you'd have to include it in the zip
http://www.sysinternals.com/Utilities/PsKill.html

Thanks for pointing that out. I can easily integrate pskill into the batch file.

Also, you might wanna add the "/-p" parameter to your dir commands in case the user has the DIRCMD variable set.

The DIR command does not work that way with the /-p parameter. I'll just set the DIRCMD variable to nothing like this: set dircmd=

Thanks

[Jim]

The whole program or script thing is tough. I found out yesterday that if you are not using a particular brand of windows or your PCs directory structure is not setup the same, it just won't work correctly.

I am almost thinking of educating surfers on the benefits of cookies and possibly suggesting a good anti-adware program. Of course, I will not change any pages. I may add a page with that suggestion and offer it to anyone that wants to use it. So far, the only way to get rid of this is to follow the instructions to the letter.

I think it may be just too big of a job to make a script and/or program that will work for all surfers suffering from this scumware.

[zman]

Originally Posted by Jim

The whole program or script thing is tough. I found out yesterday that if you are not using a particular brand of windows or your PCs directory structure is not setup the same, it just won't work correctly.

The PCs directory structure does not need to be set up in the standard way (C:Windows; C:\Program Files; etc.). The script I wrote is pretty simple but it does search for zango executables and dlls, unregisters and deletes those files. It also deletes known zango registry entries and zango cookies. I've made some minor changes since I uploaded it and I've also integrated the free process kill utility from symantec because as MightyMidget said the taskkill command is unavailable in Windows XP Home Edition. But the script still does not work under Win95/98/ME.

I am almost thinking of educating surfers on the benefits of cookies and possibly suggesting a good anti-adware program.

Of course the easiest and most effective way would be to recommend to the surfer a commercial adware/spyware remover, but as Greenie said they might think we want to make money off them.

So far, the only way to get rid of this is to follow the instructions to the letter.

My script does the same thing with a double-click of a button. I'll email you Jim with the latest version to your GGJ mail address. I've tested it out on quite a few computers and it worked fine. If it still has some flaws I should be able to make a few improvements.

I think it may be just too big of a job to make a script and/or program that will work for all surfers suffering from this scumware.

Well it's not easy but it can be done. I believe it might take a week or so to write a good remover that will work under all Windows OS's. The software should also be easy to adapt to new scumware like zango.

[Jim]

But please, since I am no programer, if anyone has anything that will work with everyone, let me know.

[EzRyder]

Since I am a simple person, I may be over simplifying a bit, but if as I understand correct, Spybot Search & Destroy(I don't think it kills cookies) checks for Zango and a kazillion other scumware types why not just put a link as to where the surfer can download and install?

I only use SS&D as an example. There are probably other scanners that might do the job.

Ok, now I am ready to hear the faults in my thinking. :-)

I am concerned about this plague, but I am not astute enough to offer any real solutions.

[virgohippy]

I've used and suggested SS&D for a few years now. I haven't heard, or experienced any problems with it either. However, things may change in the future, and relying on someone else's program to do only the specific task you intend is a bit of a risk. That being said, I wouldn't have a problem directing surfers to a page that links to SS&D.

[Greenguy]

Originally Posted by virgohippy

I've used and suggested SS&D for a few years now. I haven't heard, or experienced any problems with it either. However, things may change in the future, and relying on someone else's program to do only the specific task you intend is a bit of a risk. That being said, I wouldn't have a problem directing surfers to a page that links to SS&D.

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

[ChiTown]

Originally Posted by Greenie

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

Getting rid of it isn't that much of a prob, and blocking the IP
for the actual download isn't that hard either, block 66.152.93.119
with your firewall and you'll never get the XXXtoolbar, block
216.130.187.150 and you'll never get the isearch toolbar for example..

When Zango was LoudCash before 180Solutions bought
them U.S. prosecutors charged Jeanson James Ancheta of
Los Angeles,as well as an unnamed co-conspirator,that they
used a botnet to disseminate and install adware from
two firms: Loudcash and Gammacash!
Enter once again Gammacash!!!

[EzRyder]

I certainly understand you folks not wanting to come off as trying to make $$$ off of this. The Spybot thing is freeware and I'm sure others are also. There is a donation page on the SS&D website but it is an option not a mandatory thing. It was just an example I chose to use.

For Mr/Ms Surfer to edit their Registry is kind of scary tho. Heck, when I have done it, it makes me a bit shaky and I started in the computer biz back in '62. 1962 not 1862 a some would have you believe. ha!

Some time, someday someone will come up with a cure. I'm almost positive of that.

[virgohippy]

Originally Posted by Greenie

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

I understand the importance of credability in this situation, and I completely agree. It's important to keep the surfer's trust through all this.

But I believe SS&D is free to use and download, though they will accept donations. Tis why I agreed to the use of SS&D.

Would it be possible/easy to have two pages side by side, one that links to a single, suggested program, and one that's completely clean? It should be easy enough to pass a single argument through the url, make it switch between different types of content... but keeping track of that content is more work.

I know I wouldn't have a problem directing surfers to a site that links to SS&D, but I'm sure not everyone feels the same way.

[Greenguy]

Originally Posted by virgohippy

...Would it be possible/easy to have two pages side by side, one that links to a single, suggested program, and one that's completely clean? It should be easy enough to pass a single argument through the url, make it switch between different types of content... but keeping track of that content is more work...

I'm not sure we'd (Jim) would want to do that at this time, but feel free to set it up like that on your own domain.

All we're (Jim) doing is giving people the option to use the page on our server, but you can easily set it up to go to a page on your domain as well

[Jim]

You guys would not believe some of the crap I have learned over the past couple of days. A person that has been fighting zango for almost 3 years contacted me and he has taught me a lot about zango. These guys are some of the most devious we have ever been up against. The crap they are doing with cookies, iframes and even javascript is crazy. We have barely touched the surface with the popups. But, some of the stuff they are doing is illegal. And, they should be going to court in a few days. The illegal stuff may be their downfall... Cross your fingers.

[MrYum]

Originally Posted by Jim

You guys would not believe some of the crap I have learned over the past couple of days. A person that has been fighting zango for almost 3 years contacted me and he has taught me a lot about zango. These guys are some of the most devious we have ever been up against. The crap they are doing with cookies, iframes and even javascript is crazy. We have barely touched the surface with the popups. But, some of the stuff they are doing is illegal. And, they should be going to court in a few days. The illegal stuff may be their downfall... Cross your fingers.

Looks like they got a bit of a spanking...

http://blog.wired.com/27bstroke6/200...sage_to_i.html

Small potatoes for the fuckers, but at least it's a start

[Jim]

Shit, I just posted a link to cnet saying the same thing. The important part is they have to clearly let the surfer know they are installing pop ups and provide an easy removal tool.

[mOrrI]

Great stuff...
thanks for sharing this with us...

[mist]

Thanks for the htaccess file.

[eman]

http://www.vnunet.com/vnunet/news/21...-targets-zango

Zango spokesperson Steve Stratz called the Zango Warning site "blatant lies and scare tactics", and provided vnunet.com with a copy of an ad that the company will soon be running.

The ad, which is set to appear every time a user is re-directed to the Zango Warning site, tells the user "The Web page in question is designed to 'scare the surfer', as its 'creator' has confessed.

The makers Greenguy and Jim did not return a request for comment.

[T Pat]

Originally Posted by eman

http://www.vnunet.com/vnunet/news/21...-targets-zango

good find eman
Makes me proud to be a member of GGandJ