GreenguyandJim Fighting Zango [Archive]

View Full Version : GreenguyandJim Fighting Zango

Greenguy

2006-10-24, 10:58 AM

~Fighting Zango ~

With all the talk about Zango these past few weeks, I think the best offense is a great defence. And to me, education of the surfer is the key.

I have come up with a page that both will scare the surfer and explain how to get rid of this software. I also have an htaccess file that will detect Zango users and redirect them to this page.

I need to let you know that this page is only way to help the surfers clean their PCs. There are not nor will there ever be any ads on this page. And, it will always be there for your surfers. You really have nothing to lose...you won't make any money from these surfers anyway.

Here is the url for the page I created...
http://www.adwaresucks.com/zango/

And the htaccess file can be found here...
http://www.adwaresucks.com/zango/zangohtaccess.txt

You may use this if you would like. We have tested it and it appears to be working very well.

As more of these adware/spyware products surface that will take money from webmasters and programs alike, I will make a new directory, page and htaccess file.

I hope all of this helps.
Jim

Licker4U

2006-10-24, 11:32 AM

Is that htaccess a seperate line under what I already have in place or is some of it to be slipped in along with what's already there?

Greenguy

2006-10-24, 11:56 AM

I put it 1 space under what I already had in there & it seems to be working fine.

RedCherry

2006-10-24, 12:15 PM

Thanks Greenie, just put that on all my LL domains. Sucks they we have to do that to keep them from stealing traffic.

Jim

2006-10-24, 12:16 PM

After looking at the stats with Greenie, we calculated that he had about .15% of his traffic sent to the page over about a 24 hour period.

So, out of 2000 people going to link-o-rama, 3 were infected with zango.

While some people are afraid to lose anyone from their site, the percentage is tiny. And as I said in a previous thread, if these 3 people out of the 2000 grouping remained on link-o-rama, they would have had a zango popup show up and would have blamed Greenie, not zango. If these were loyal bookmarkers, he most likely would have lost them.

ponygirl

2006-10-24, 12:17 PM

nice job |thumb
I hope it will make a difference if enough of us use it

Simon

2006-10-24, 02:12 PM

I have the htaccess code added on xratedtv now and I'll be adding it to our other feeder domains this week.

I kind of doubt that most Windows users are comfortable doing the things the "infected" page tells them they need to do. And some won't do it based on it being a porn site that tells them to do it (LOR and others with loyal surfers being the exceptions).

My guess is a good percentage will bail when they read what they need to do, and just go hunt some porn. But I think Ponygirl's point is right. If that surfer sees it happen to him again and again on enough sites he'd like to visit, it may make the difference.

So we really do need to get this message out to a lot of webmasters if we want it to have a marked effect. The adwaresucks domain certainly is fine for mainstream sites to use the message there too.

Jim

2006-10-24, 02:21 PM

We are actually working on some other things right now. There is another nasty piece of software coming down the road that makes zango look like a walk in the park.

We are coming up with a new htaccess code that will allow surfers to just go back to your site without being sent back to the page.

We are talking about quite a few things that will help all of us.

Greenguy

2006-10-24, 02:27 PM

...I kind of doubt that most Windows users are comfortable doing the things the "infected" page tells them they need to do. And some won't do it based on it being a porn site that tells them to do it (LOR and others with loyal surfers being the exceptions).

My guess is a good percentage will bail when they read what they need to do, and just go hunt some porn. But I think Ponygirl's point is right. If that surfer sees it happen to him again and again on enough sites he'd like to visit, it may make the difference...Even if they ignore it, at least we tried :)

digifan

2006-10-24, 03:29 PM

Posted it at the askdamagex board as quotation from the newsletter :)
Link can be found here, big tgp owners also have a lot to lose if they don't fight them...
http://www.askdamagex.com/showthread.php?p=101116#post101116

rachelo

2006-10-24, 03:44 PM

All this technical stuff, I wish I knew more.

So if I want to add the. htaccess file to my domain, just copy the text Greenie provided and add it to my existing file?

Is that it?

JustRobert

2006-10-24, 03:46 PM

I believe this is now the main thread so I will post on this one.

Should the following line: "Zango is attempting to monitor user activities on your computer. If allowed it may try to track or log keystrokes (user input), mouse movements/clicks, Web sites visited, and other user behaviors." be set in a different color than black. This is the selling point of the page to me and a bolder color would help draw attention of the surfer to it visually as well. Since most people only do quick scans.

Just a thought. :)

Greenguy

2006-10-24, 04:07 PM

Hold Off On Everything!

Sparky is working on a little customizable interface for this - we should have a better version in time for the Radio Show.

kenny

2006-10-24, 04:33 PM

What about spybot?

Does that remove Zango?

Toby

2006-10-24, 04:44 PM

What about spybot?

Does that remove Zango?Zango *is* in the list of items that SpyBot detects.

kenny

2006-10-24, 05:02 PM

Zango *is* in the list of items that SpyBot detects.

Ok then why not just inform the surfer that spyware has been detected on their computer and have them download spybot?

Since spybot regularly updates and will remove the other big parasites as well.

That way you don't have to worry about instructing the surfer on how to remove adware manually

Greenguy

2006-10-24, 05:41 PM

Ok then why not just inform the surfer that spyware has been detected on their computer and have them download spybot?....The problem (aside from the fact that it'd look like we were trying to make money off some removal program) is that all the removal programs Jim looked into also removed a lot of other things, like cookies (buh-bye CCBill transactions) so as of right now, the best thing we can think of is to tell people how to remove it by hand.

But Jim is working on finding a program that will just remove Zango (and any others that we come across) without getting rid of everything else that the removal programs deem "issues"

Jim

2006-10-24, 06:33 PM

Well, we have something. It's not pretty but it does do the job.
It will now allow your own css file, will return surfers that don't uninstall zango and even builds you your own htaccess file.
http://adwaresucks.com/webmasters/

I just want you guys to be on the cutting edge. It will be pretty within a day or two.

MrYum

2006-10-24, 09:53 PM

johnnybg

2006-10-25, 04:29 AM

It's great to see we are fighting this menace. For years they are stealing sales from us, it's time to act.

Excellent stuff!!!

darksoul

2006-10-25, 05:56 AM

giving credits where its due would be nice
http://www.gofuckyourself.com/showthread.php?t=667179

eman

2006-10-25, 05:57 AM

Good work chaps :)

Jim

2006-10-25, 08:00 AM

giving credits where its due would be nice
http://www.gofuckyourself.com/showthread.php?t=667179

darksoul
If I saw that, I probably would have asked you to work together with us. Good Job. But, I really don't go to GFY very often. I went there yesterday because I saw someone on a different board copied a post from GFY with my name in it. Otherwise, you might see me there twice/month when I get bored.

As I told everyone yesterday, steal our page and do what you want with it. The important thing is to get the word out.

I am almost positive that you didn't hear our radio show last night but we are turning adwaresucks.com into a scumware fighting machine. We are setting it up to read a pc to check for any scumware and will redirect to the proper instructions no matter what they have installed. The nearest count is 450 of these programs running right now. And some of them using cookie stuffing that makes zango look like nothing.

I just read your thread and I noticed that your page was not welcomed with open arms. I think you and I are on the same page. Informing the surfer about any of these programs is key in fighting it.

I see that you are sending people away from your page to software that is going to remove cookies as well as zanga. You probably should rethink that...without cookies, you have no ccbill sales.

Anyway, nice work and if you have any ideas for adwaresucks, let me know.

Jim

2006-10-25, 08:04 AM

eman

2006-10-25, 08:18 AM

Oh yeah, I see Lars said it was about .5 percent of surfers with zango. We will have real numbers later today. But, we have seen sites with up to 4 percent infected. But, that was Lars, he seems to be fighting for the other side.

Reading Lars' latest promotional thread on GFY, and the seemingly (unseemly) unanimous roars of approval, you'd be hard pressed to imagine that there were sides.

darksoul

2006-10-25, 08:43 AM

darksoul

2006-10-25, 08:53 AM

Also please note that the javascript history.go(-1)
won't set the referer to adwaresucks.com making

RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*adwaresucks\.com(:[0-9]+)?(/.*)?$ [NC]

useless and the user will be caught into a loop and wont be able to go back to the originating site.

Jim

2006-10-25, 09:32 AM

I can't address the code since I didn't write it but I'm sure when the person that did will correct you...or not.

As far as the coincidence, that would be exactly what it is. If you knew me at all you would know that the last place I go is gfy. I would much rather take care of business than to look at Lindsey Lohan's latest nip slips. Our pages look nothing alike. Or are you talking about the idea? I'm sure you and I are not the first to come up with a redirect for people using a scumware program. As a matter of fact, I saw a mainstream site that started doing it in 2003 yesterday.

But go ahead...question my honesty again.

darksoul

2006-10-25, 09:39 AM

I can't address the code since I didn't write it but I'm sure when the person that did will correct you...or not.

Waiting for that.

As far as the coincidence, that would be exactly what it is. If you knew me at all you would know that the last place I go is gfy. I would much rather take care of business than to look at Lindsey Lohan's latest nip slips. Our pages look nothing alike. Or are you talking about the idea? I'm sure you and I are not the first to come up with a redirect for people using a scumware program. As a matter of fact, I saw a mainstream site that started doing it in 2003 yesterday.

But go ahead...question my honesty again.

I'm not talking about the page. But about the idea.
Notice, I didn't have anything against making your own page
and using that stuff. I don't care, I put the solution there to be used.
But if the thing is indeed taken from there and pretend to be your own solution that would majorly suck, don't you think ?

Jim

2006-10-25, 10:08 AM

I agree that it would suck...
And perhaps if you had posted it on a webmaster only board, you might have some type of claim. The fact alone that I only surf webmaster/surfer boards when greenguyandjim is mentioned should be enough. And most times with most people, my word is good enough.

But, if you look at this thread...about post number 19
http://www.greenguysboard.com/board/showthread.php?t=35453
you will see my thought process. It would have been a lot easier if I did see your post. :) I even had to ask our guy what htaccess file I should use. Again, if I saw your post, I wouldn't have had to do that.

All in all, the idea has been around since at least 2003. I have read so much in the past few days about zango so I can't point you to the page I am talking about. (Please take my word for it) But, I suppose that person can come out and say we both stole his idea. And yet, I saw it yesterday and you probably haven't seen it at all.

Truthfully, I didn't see your post. As I said, if I did, I would have asked you to be involved in somthing that is going to be much bigger than just zango. We are basically on the same page with this thing.

There is a ton of work to be done. If you would like to help us, that would be great.

But please, don't question my honesty or integrity. Call me a piece of shit, asshole...etc. But, I have been in this business for over 10 years. And nobody ever questions my honesty. This is why so many people are using adwaresucks.com. Webmasters know I am never going to do anything to hurt them.

TopbucksTrixxxi

2006-10-25, 10:21 AM

After being told it's not a good idea everytime this year, I'm glad a few of you have taken your coding knowledge and got pro-active to do something with it.

I will be using it on my sites for sure. Thanks

Greenguy

2006-10-25, 10:22 AM

giving credits where its due would be nice
http://www.gofuckyourself.com/showthread.php?t=667179

...I'm not talking about the page. But about the idea.
Notice, I didn't have anything against making your own page
and using that stuff. I don't care, I put the solution there to be used.
But if the thing is indeed taken from there and pretend to be your own solution that would majorly suck, don't you think ?

Just a question: can you show me where you gave SmokeyTheBear credit for the idea, since he posted this: http://www.gofuckyourself.com/showthread.php?t=665894 - on October 13th 4 days before you posted yours?

Or maybe you didn't see that thread? Sorta like Jim didn't see that one or your thread or any of the other threads that you can find by throwing some words into Google?

darksoul

2006-10-25, 10:30 AM

Just a question: can you show me where you gave SmokeyTheBear credit for the idea, since he posted this: http://www.gofuckyourself.com/showthread.php?t=665894 - on October 13th 4 days before you posted yours?

Or maybe you didn't see that thread? Sorta like Jim didn't see that one or your thread or any of the other threads that you can find by throwing some words into Google?

I really don't see the connection.
Can you point me to where he remotely mentions anything
about the User Agent Zango uses ?

Did you even read what that code does ?
let me quote it for you:

basically what we are doing is setting our sponsor in a frame from an external file that cant be read by zango thus its not "readily" apparent where the hit is going..

darksoul

2006-10-25, 10:35 AM

Greenguy

2006-10-25, 10:37 AM

Ok - you got me :) I'm not a tech guy - I just threw "zango htaccess redirect" into google, saw that thread come up, saw that it had coding on it that I have no idea what it does, saw the date.....

My bad. I apologize.

Jim

2006-10-25, 10:42 AM

It doesn't matter Greenie. You know, Sparky knows and anyone I talked to about this knows that I never saw his post. Hell, anyone that knows me knows I didn't see his post. I don't want this to cloud what we are trying to do.

But please darksole, change your page to not send people to anti-adware software. Unless you found a free one that leaves cookies alone. And if you did, please share.

Greenguy

2006-10-25, 10:42 AM

btw, this post pretty much proves my point.

Its like: "Yes I stole it, but look so did you, so I'm ok to do that"

peaceThat's not what I was trying to say! My point (which is moot now) was that if there is another thread or page ANYWHERE on the internet that's dated prior to yours on how to redirect zango surfers - and assuming that you did not read it yourself - would you too be considered a thief?

darksoul

2006-10-25, 10:44 AM

Heres the right code to use

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ZangoToolbar [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*)?yourdomain\.com(.*)$ [NC]
RewriteCond %{HTTP_REFERER} !^http://(.*)?adwaresucks\.com(.*)$ [NC]
RewriteRule .* http://www.adwaresucks.com/zango/?ref=yourdomain.com [R=302,L]

on your Zango page:

<?php
$ref = $_REQUEST['ref']
..........
if($ref) {
echo "<a href='http://$ref'>Go Back</a>";
?>

darksoul

2006-10-25, 10:47 AM

It doesn't matter Greenie. You know, Sparky knows and anyone I talked to about this knows that I never saw his post. Hell, anyone that knows me knows I didn't see his post. I don't want this to cloud what we are trying to do.

I didn't said you did. When I initially posted, I was talking with the
thread poster but you popped out beeing defensive.

But please darksole, change your page to not send people to anti-adware software. Unless you found a free one that leaves cookies alone. And if you did, please share.

My page is a Proof of Concept, everyone should do his own page

darksoul

2006-10-25, 10:50 AM

That's not what I was trying to say! My point (which is moot now) was that if there is another thread or page ANYWHERE on the internet that's dated prior to yours on how to redirect zango surfers - and assuming that you did not read it yourself - would you too be considered a thief?

If I'd use something I didn't do, I'd make sure I don't get credits for it.
This thing is hardly something to call someone a thief for, I put it there
for everyone to use. But I think its common courtesy to give credits where its due.

cd34

2006-10-25, 10:57 AM

Jim,
I think the coincidence is a bit too big!
plus you modifyed that .htaccess so badly that you even broke it

RewriteCond %{HTTP_REFERER} !^$

this means that users with no referrers won't be redirected
if they have ZangoToolbar. Why would you want that ?

RewriteCond %{HTTP_REFERER} !^http://(.*@)?([a-z0-9-]+\.)*yourdomain\.com(:[0-9]+)?(/.*)?$ [NC]

yourdomain.com\.com(:[0-9]+)? makes no sense either because in mod_rewrite language it means:
"the url might be of the form yourdomain.com:135" or any other group of digits
Is that a new tld extension ?

Using stuff like (.*@)?([a-z0-9-]+\.)* is overkill when you can simply use (.*)? which will match anything.

First off, I don't surf gfy, I think I probably have one post there. I never saw your post, I didn't know about your solution, but, I don't see that there is any other way to do a webmaster friendly solution without doing it this way.

So, any similarity is just two people coming up with the same answer for the same problem. I got involved with this from a code perspective yesterday morning after seeing what Greenguy and Jim had done and came up with a solution that was a little more robust and flexible than their first version.

As for allowing the empty referrer, surfers use privacy software which blocks the referrer. Using your example .htaccess, if a surfer running privacy software hits your site, they get redirected to dark5.com, but, since they don't set a referrer, how do they get to click on the link back to your site? Try it in firefox, go into about:config and change network.http.sendRefererHeader to 0 and you should get stuck in the loop. (unless that should be a 3 to not send the referrer -- their config values are a bit cryptic and I didn't test firefox to verify)

It seemed to be a compromise that affected the fewest number of people.

As for properly supporting RFC3986 uri constructs, call me guilty. Ray Morris from StrongBox/bettercgi developed those when we were dealing with hotlinking with a bit of input from the board to make sure that any valid url construct would be covered, but, mangled urls would not be allowed access. I merely copied known tested, valid and working url constructs that absolutely supported every condition we threw at it ages ago.

RewriteCond %{HTTP_REFERER} !^http://www.yourdomain.com.*$ [NC]

Imagine someone bookmarking a members area as http://user:password@www.yourdomain.com/members or someone surfing from a subdomain of http://www4yourdomain8com.someother.info. The members area one would be redirected, whereas the person surfing from someother.info would be granted access.

If a surfer hits http://yourdomain.com/ -- they would be redirected for not having the www.

I still support the .htaccess the way that it was written in part to conversations held directly with Greenguy and Jim and in part due to conditions I thought of that would unnecessarily complicate issues for a surfer. As you have mentioned the javascript back button doesn't make sense, and that was addressed yesterday in private conversations with Greenguy and Jim as were a number of other issues that haven't been raised yet.

I'll state for the record right now that I didn't take your idea and today is the first that I even knew about it. I commend you for coming up with a solution prior to there being demand.

spookyx

2006-10-25, 11:04 AM

I would like to follow up on what we chatted about last night in the channel about "anti zanga approved sponsors" we would be happy to make the banners that were mentioned. hit me up on icq or email me

we at lotzadollars are committed to supporting our honest affiliates and won't put up with these kinds of scams.

we also appreciate all the positive feedback lotza received for takng this stand
|thumb

Greenguy

2006-10-25, 11:07 AM

I didn't said you did. When I initially posted, I was talking with the
thread poster but you popped out beeing defensive....Are you that dense that the fact that this board is owned by Jim & myself and that when I post something that we are doing together, that means it's a joint project & the fact that I was the one that started the tread is moot? This is more Jim's project than it is mine, so when you call him a thief, you have to expect that he's going to reply.

If I'd use something I didn't do, I'd make sure I don't get credits for it.
This thing is hardly something to call someone a thief for, I put it there
for everyone to use. But I think its common courtesy to give credits where its due.
You're not the 1st one to make up some htaccess coding to redirect surfers with adware installed - and if Jim & I have to sit here all fucking day trying to find a page that's dated prior to Oct 17, then that's what we'll fucking do.

darksoul

2006-10-25, 11:08 AM

...

Hey, I appreciate your long post.
but you don't really know how mod_rewrite works.
There are legit no referer surfers, surfers that come to your site
by typing your url in the address bar.

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ZangoToolbar [NC]
RewriteCond %{HTTP_REFERER} !^$
...
RewirteRule .* http://www.adwaresucks.com/zango/ [R,L]

let me translate this code for you in human language:

If the User has Zango Toolbar installed and he's comming from no referer
or from adawaresucks or from yourdomain then DON'T redirect him.
The user is redirected only if it has Zango Toolbar and its not coming from (no referer) , adwaresucks, yourdomain.com

You can easily see that all no referer users are NOT sent to the Zango page and I really don't see the reason for it.

darksoul

2006-10-25, 11:14 AM

Are you that dense that the fact that this board is owned by Jim & myself and that when I post something that we are doing together, that means it's a joint project & the fact that I was the one that started the tread is moot? This is more Jim's project than it is mine, so when you call him a thief, you have to expect that he's going to reply.

I didn't called anyone a thief, and you just proved Jim was in the wrong to begin with.

You're not the 1st one to make up some htaccess coding to redirect surfers with adware installed - and if Jim & I have to sit here all fucking day trying to find a page that's dated prior to Oct 17, then that's what we'll fucking do.

Are you trying to make it excusable for you ?

Its ok, I'll give you all credits, you can apply for a patent.

Greenguy

2006-10-25, 11:19 AM

What I'm trying to prove to you is that NO ONE HERE READ YOUR THREAD ON GFY!

2 parties came up with a similar solution - you posted yours 1st & no one is disputing that.

But by you asking for credit, you're saying that Jim did read it & that he stole the idea from you.

mniki

2006-10-25, 11:20 AM

cd34

2006-10-25, 11:20 AM

You can easily see that all no referer users are NOT sent to the Zango page and I really don't see the reason for it.

Here's the scenario that I came up with that was a problem.

Surfer with privacy software that doesn't send a referrer hits the site, has the ZangoToolbar installed. They are redirected.

They read through the page, remove the links, but, haven't restarted IE yet. While the toolbar is indeed removed so that the next time they run IE, it won't advertise the ZangoToolbar user agent, their current surfing session will still say that ZangoToolbar is installed.

They click the link at the bottom of the page, continue on to the site.

Their referrer is still blank due to the privacy software, the user is then redirected back to the Zango page.

I saw no simple way to keep that surfer without allowing the empty referrer.

Setting a cookie would be a little nasty and would lump any efforts right back into the antispyware vendors that pop up ads every time someone visits a site. Not to mention, their privacy software probably wouldn't accept the cookie in the first place. Requiring webmasters to install a small script that checked an IP database against surfers that had originally hit the site would work, unless the surfer used AOL and their apparant IP address changed from one of AOLs multiple proxies.

I felt it was a compromise that seemed to affect the smallest group of people without irritating a large number of people.

darksoul

2006-10-25, 11:25 AM

Jim

2006-10-25, 11:28 AM

darksole, you are right...I am a theif. CD34 knows nothing about server software, Greenguy is an uneductated ass and guess what???

You are gone...

darksoul

2006-10-25, 11:29 AM

darksole, you are right...I am a theif. CD34 knows nothing about server software, Greenguy is an uneductated ass and guess what???

You are gone...

easy way out.
you should've applied it from the beginning.

Jim

2006-10-25, 11:38 AM

ooops, squeeked a post in before I got to the ban button.

MrYum

2006-10-25, 11:43 AM

well,
Are you so keen on what you did that even if its broken you want to keep it ?
I offered you the easy fix, and this cd guy which I assume is your coder
comes to prove he has no understanding of what he does.

You can apply my fix from above, or make your own fix but don't persist just for the sake of it.
Wow...having read through this exchange...someone had a big bowl of cranky flakes this morning.

Darksoul, obviously you don't know these guys. Greenguy, Jim and cd34 are some of the most honest guys you'll come across in this business. IF their idea had originated from your post, you can be damn sure they would have given you the credit that you so desperately desire.

Useless

2006-10-25, 11:56 AM

I just hope that someone is going to give credit to whomever the original .htaccess coders/inventors were - or else they're going to be pissed!

|waves| darkassoul

Jim

2006-10-25, 12:06 PM

The thing is, I have no doubt that a bunch of people came up with the same idea around the same time. I invented nothing...all I did was spend 2 minutes writing the page and asked Sparky for an htaccess file that worked. Pretty much you guys saw my thought process in the other thread.

I didn't surf gfy one day looking for the latest pictures of cars they wished they owned and claim they do and stumble on his post.

As a matter of fact, boardtracker told me that there was another post about me on a different board. I went to read it and saw that it was copied from gfy. So, I went to gfy to explain how it all worked and even thanked the people saying good job. If I stole it from someone posting on gfy, I wouldn't go anywhere near there.

I have no idea why I am explaining it to you guys. You know the truth and I guessed the guy lost all credibility when he said Sparky didn't know what he was doing. That is, if he didn't from his second post.

Good to see you Useless :)

EzRyder

2006-10-25, 12:33 PM

Jim

2006-10-25, 12:51 PM

Does it really matter who thought of what first? The idea in the beginning was to combat something that has been going on far, far to long.

"why can't we all get along?" sort of a quote from someone but CRSis kicking in and I can't remember who?

I tried by letting him know if he wanted to help we would welcome it.

And your quote...I keep thinking, Larry King :) Someone King, I know that much :)

Simon

2006-10-25, 12:52 PM

Maybe you mean Rodney King (http://en.wikipedia.org/wiki/Rodney_King)?

"People, I just want to say, you know, can we all get along?"

Surely don't want to misattribute anything in this thread.

;)

Jim

2006-10-25, 01:29 PM

Maybe you mean Rodney King (http://en.wikipedia.org/wiki/Rodney_King)?

"People, I just want to say, you know, can we all get along?"

Surely don't want to misattribute anything in this thread.

;)

You mean it wasn't Larry King? :)

MightyMidget

2006-10-25, 03:56 PM

Hehehe, just too funny... That guy's got the attitude of a warez d00d or cracker with his phearsome sKillZ, so good riddance

virgohippy

2006-10-25, 03:58 PM

Sorry to interupt discussion :)

It may sound like stupid question but I am not very good at this.
Need explanation about htaccess, Under same domain name have TGP and LL. Would It be enough to put It In public_html folder of my domain name or should I put separatly htaccess 1 for TGP and 1 for LL.

Looks like your post nearly got lost in the |catfight|.

htaccess gurus, correct me if I'm wrong

I think it depends on how you have your dir structure set up. If you have an htaccess file in a folder it is considered a replacement for any htaccess files closer to the root domain.

If you have an htaccess file in the following:
yourdomain.com
yourdomain.com/dir1/

The htaccess file at the root (yourdomain.com) will not affect anything inside dir1, however it will continue to affect:

yourdomain.com/dir2/
yourdomain.com/dir3/

The htaccess file in dir1 will affect anything deeper than dir1:

yourdomain.com/dir1/subdir1/
yourdomain.com/dir1/subdir2/

htaccess is an all or nothing deal. If it's affecting dirs, then it's affecting them. If it's not, then it's not.

Does that answer your question?

cd34

2006-10-25, 04:12 PM

Virgohippy's explaination is correct, however, you can add

RewriteOptions inherit

in an .htaccess that is below a parent .htaccess and it will use the rules from both.

So, you could set up your main rules in yourdomain.com/.htaccess, and add additional rules in yourdomain.com/dir1/ with the

RewriteOptions inherit

And the files served in /dir1/ would utilize both.

Linkster

2006-10-25, 06:47 PM

Cant we all get a long? - Hmm I always thought it was Cant we all get a long neck:

Oh, why can’t we all just get a long neck?
And make a toast to peace and harmony
Why why cant we all just get a long neck?
See how good gettin’ along might be

I’d like to buy the world a round
In a honky tonk on neutral ground
Where we can see inside we’re all the same
Pop a top and let the good times pour
‘Til we forget what we’re fighting for
I’ll ask again could someone please explain?

Hank Williams Jr

Course it may just be where I live :) since I know Guttermouth did a song similar to this |jester|

mniki

2006-10-25, 07:29 PM

Thx virgohippy and cd34 for help and explanation

Quick Buck

2006-10-25, 09:40 PM

Jim,

Don't you think it would be more effective to display a dhtml popup than to redirect the surfer?

I mean sure, greenie only sees .15%, but some people probably see 10% and that means they'd be sending 10% of their surfers to another site... now i'm not saying that it's bad to tell people they have zango, but the way zango works, a user only gets a pop every hour or two, so the odds of them popping a new browser on your page is actually very small if the surfer is navigating link lists and tgp's because they are likely hitting 10's or hundreds of domains.

I would think that a dhtml ad would be more effective because the user could close it if they wanted.. your method seems like (unless i'm misunderstanding it) that it redirects every zango surfer away from the site.

This could be done easily with some javascript.

zman

2006-10-25, 10:09 PM

Hey QuickBuck,

Zango does not work that way.
If the surfer has Zango installed even if he types in the url manually in IE 6,
Zango changes the HTTP_USER_AGENT from MSIE 6.0 to ZangoToolbar.
There's no need for Zango to popup a new browser window to be detected.

tickler

2006-10-26, 12:09 AM

An additional thought about dumping all Zango users, and it ties in with a comment I made about how sponsors should only red flag sales showing the user_agent and then investigate the referring URLs.

The surfer can still buy a membership, and the right WM would still get credit: If the link/keyword has not been sold by Zango.

As far as the low number of surfers being detected, remember that a lot of these installs where done for other reasons than porn, like games/musics/etc. So a lot of the infected computers may never hit a porn site.

Danielle

2006-10-26, 02:10 AM

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

Hugs,
Danielle

zman

2006-10-26, 02:20 AM

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

Hugs,
Danielle

I wish I would have an answer for you :(

virgohippy

2006-10-26, 02:32 AM

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

No solution here, but a concern to go along with this whatif: I'd be wary of any solution that promotes a script/program that invades the privacy of a surfer's system. Anything more than detecting HTTP_USER_AGENT could start pushing things in the wrong direction... |sad|

babymaker

2006-10-26, 03:52 AM

well i applaud the effort and it's nice to see action taken :D I have to say if i was zango, i would just take a few keywords off the landing page and put a system wide ad to pop a spyware removal site or any porn site etc and grab all that traffic back....................

zman

2006-10-26, 04:52 AM

I've made quite a bit of research the last couple of days and this is what I came up with.
It's a batch file I wrote which is intended to totally remove Zango from the surfers computer.
It basically does the same thing as Jim's tutorial says plus a few things like removing Zango start menu shortcuts,
Zango cookies, windows prefetch data and all the registry entries I could find were created by it.

@echo off
cls

set TMPF1=%TEMP%\dzf.tmp
set Prefetch=%WinDir%\Prefetch

echo 1. Terminating known Zango processes.
taskkill /f /im "zanu.exe" /im "zango.exe" > nul 2>&1
echo.

echo 2. Searching for and unregistering Zango DLL's.
for /r "%ProgramFiles%\" %%i in (*zangohook.dll *ZbAds.dll *ZbCoreSrv.dll *ZbHostIE.dll *ZbToolbar.dll) do (regsvr32 /u /s "%%i"
echo "%%i" - OK)
echo.

echo 3. Locating and deleting Zango files and folders.
echo This may take a while... Please be patient.
if exist %TMPF1% del %TMPF1%
pushd %ProgramFiles%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (
dir "%%i\" /a-d /b >> %TMPF1% 2> nul
rmdir /s /q "%%i\")
echo %ProgramFiles%\ - OK
popd

pushd %AllUsersProfile%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (rmdir /s /q "%%i\")
for /f "delims=" %%i in ('dir /a /b /s ^| find /i "zango"') do (del /f /q "%%i")
echo %AllUsersProfile%\ - OK)
popd

pushd %UserProfile%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (rmdir /s /q "%%i\")
for /f "delims=" %%i in ('dir /a /b /s ^| find /i "zango"') do (del /f /q "%%i")
echo %UserProfile%\ - OK
popd

if exist %TMPF1% for /f "delims=" %%i in ('find /i ".exe" %TMPF1% ^| find /i /v "%TMPF1%"') do (
del /f /q "%Prefetch%\%%i*" >nul 2>&1)
del /f /q "%Prefetch%\*zango*" >nul 2>&1
del /f /q "%TMPF1%" >nul 2>&1
echo %Prefetch%\ - OK
echo.

echo 4. Cleaning up known Zango registry entries.
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "zanu" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "zango" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zango TvTimes" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZangoToolbarWebTools" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{7B178417-3CDA-444F-94FF-312C0A3A78A8}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{68BF4626-D66B-4383-A6AF-62E57E9B6CD4}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{E5B57AB3-15F8-43A2-ABAC-3E58A9C25818}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ncmyb.SABHO" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ncmyb.SABHO.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jade Shadow" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zango TV Times" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\zanu" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\ZangoToolbar" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\zango" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\zanu" /f >nul 2>&1
echo HKEY_LOCAL_MACHINE - OK
reg delete "HKCR\ZbSrv.ZbCoreServices" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices.1" /f >nul 2>&1
reg delete "HKCR\Typelib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKCR\Typelib\{DC92EE2E-DF2D-4A80-A48B-17377C81CFC2}" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx.1" /f >nul 2>&1
reg delete "HKCR\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKCR\Interface\{E43DFAA6-8C16-4519-B022-8792408505A4}" /f >nul 2>&1
reg delete "HKCR\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKCR\Interface\{BDDDF1A5-51A9-4F51-B38D-4CD0AD831B31}" /f >nul 2>&1
reg delete "HKCR\Interface\{BD31DF26-7178-41F4-88DD-F16B82D827CA}" /f >nul 2>&1
reg delete "HKCR\Interface\{A16650A9-B065-40EC-BBD1-F8D370D17FB1}" /f >nul 2>&1
reg delete "HKCR\Interface\{89D36231-6BD9-4E20-BBA0-FD28C3A83C40}" /f >nul 2>&1
reg delete "HKCR\Interface\{7FA8976F-D00C-4E98-8729-A66569233FB5}" /f >nul 2>&1
reg delete "HKCR\Interface\{72FEEB09-BB27-46D3-A06D-930D4D544227}" /f >nul 2>&1
reg delete "HKCR\Interface\{6C092742-10FE-4DB2-988D-FC71948DE70C}" /f >nul 2>&1
reg delete "HKCR\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKCR\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKCR\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKCR\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX.1" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices.1" /f >nul 2>&1
reg delete "HKCR\Typelib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKCR\Typelib\{DC92EE2E-DF2D-4A80-A48B-17377C81CFC2}" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx.1" /f >nul 2>&1
reg delete "HKCR\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKCR\Interface\{E43DFAA6-8C16-4519-B022-8792408505A4}" /f >nul 2>&1
reg delete "HKCR\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKCR\Interface\{BDDDF1A5-51A9-4F51-B38D-4CD0AD831B31}" /f >nul 2>&1
reg delete "HKCR\Interface\{BD31DF26-7178-41F4-88DD-F16B82D827CA}" /f >nul 2>&1
reg delete "HKCR\Interface\{A16650A9-B065-40EC-BBD1-F8D370D17FB1}" /f >nul 2>&1
reg delete "HKCR\Interface\{89D36231-6BD9-4E20-BBA0-FD28C3A83C40}" /f >nul 2>&1
reg delete "HKCR\Interface\{7FA8976F-D00C-4E98-8729-A66569233FB5}" /f >nul 2>&1
reg delete "HKCR\Interface\{72FEEB09-BB27-46D3-A06D-930D4D544227}" /f >nul 2>&1
reg delete "HKCR\Interface\{6C092742-10FE-4DB2-988D-FC71948DE70C}" /f >nul 2>&1
reg delete "HKCR\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKCR\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKCR\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKCR\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX.1" /f >nul 2>&1
echo HKEY_CLASSES_ROOT - OK
reg delete "HKCU\Software\zanu" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\ZangoToolbar" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\zango" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser" /v "{5CBE2611-C31B-401F-89BC-4CBB25E853D7}" /f >nul 2>&1
reg add "HKCU\Software\Microsoft\RAS Autodial\Control" /v "LoginSessionDisable" /t REG_DWORD /d 0 /f >nul 2>&1
echo HKEY_CURRENT_USER - OK
echo.
echo All Done!
pause

I believe it would be much easier for the surfer to double-click a file and get rid of that Zango crap than to manually delete all
those registry entries and files.

The downside of this batch file is that it does not run under Win95/98/Me because some of the commands I've used are
only available under Win2k and later. I've tested this on Windows XP Pro with Service Pack 2 and it worked flawlessly.

If there's anybody out there who could test it on other OS's and let me know I would appreciate it.

Licker4U

2006-10-26, 09:13 AM

I believe it would be much easier for the surfer to double-click a file and get rid of that Zango crap than to manually delete all
those registry entries and files.

I agree. Not everyone is going to feel comfortable going into the guts of their computer and deleting files.

babymaker

2006-10-26, 03:56 PM

I agree. Not everyone is going to feel comfortable going into the guts of their computer and deleting files.

i agree on that, you have to remember that these sufers are probably not that internet or computer savy, they voluntarily infected their computers with a "virus" spyware. Unfortunetly, these are also the people who still believe in $1 trial offers lol, and other things like that and probably convert 1:1 lol, so when people think well it's only 2.8% etc, maybe so, but it could be 80%+ of your 1:200 or so conversions.

virgohippy

2006-10-27, 03:14 PM

i agree on that, you have to remember that these sufers are probably not that internet or computer savy, they voluntarily infected their computers with a "virus" spyware. Unfortunetly, these are also the people who still believe in $1 trial offers lol, and other things like that and probably convert 1:1 lol, so when people think well it's only 2.8% etc, maybe so, but it could be 80%+ of your 1:200 or so conversions.

Good point, babymaker.

Now imagine how much trust a surfer would develop with a site if that site not only informs them of malicious software on their system, but helps them remove it too... and still gives them free porn samples. |thumb

babymaker

2006-10-27, 03:27 PM

Good point, babymaker.

Now imagine how much trust a surfer would develop with a site if that site not only informs them of malicious software on their system, but helps them remove it too... and still gives them free porn samples. |thumb

True, but not by having them do it manually i dont think they will dare, we need a program for them to use, even if it deletes cookies, the cookies get replaced anyway, as soon as they click back to the site.

zman

2006-10-27, 04:20 PM

Hey babymaker,

What's wrong with the remover I wrote? It's not a program, just a batch file, but it does the job and it does not delete all your cookies only the ones created by the zango toolbar.

babymaker

2006-10-27, 04:47 PM

Hey babymaker,

What's wrong with the remover I wrote? It's not a program, just a batch file, but it does the job and it does not delete all your cookies only the ones created by the zango toolbar.

|thumb yea, that's great! :) forgot about that, been busy.

heywood

2006-10-28, 07:10 AM

Thank you for doing this. I will be installing this .htaccess on all my sites. Your page inspired me to write a freeware tool, that does everything on your page in one click.

This is for users who are afraid to go in their registry, or hunt around for files.

http://www.messedup.net/zango/zangodrop.zip

Feel free to add it to your sites, Jim, if you want to add it that page, or any page, it's cool by me. 100% freeware.

heywood

2006-10-28, 07:12 AM

Hey babymaker,

What's wrong with the remover I wrote? It's not a program, just a batch file, but it does the job and it does not delete all your cookies only the ones created by the zango toolbar.

Is there any way I can get that file, or a list of the cookies it uses? I'd like to add that into my program as well.

zman

2006-10-28, 09:00 AM

Is there any way I can get that file, or a list of the cookies it uses? I'd like to add that into my program as well.

It's attached to my post on the previous page of this thread.

Jim

2006-10-28, 11:15 AM

Thanks guys
I should be near 100% on Monday...or close to it. As I mentioned the past few days, I am really sick. I will get in touch with both of you about adding them to adwaresucks.com
We have seemed to have caught the medias attention. I received an email from a mainstream scumware fighting site asking for an interview and a few others.

We are going to have to come up with something easily editable where we can add new programs as they surface. Cookie stuffing is the worst thing we will see happen and it is coming on us like a train. Imagine, someone with this software installed will click on a ccbill link and someone else will be credited with the sale. And nobody will see this happening.

tickler

2006-10-28, 03:10 PM

Cookie stuffing is the worst thing we will see happen and it is coming on us like a train. Imagine, someone with this software installed will click on a ccbill link and someone else will be credited with the sale. And nobody will see this happening.
Do you think maybe you could drag ccBill, and some of these sponsors out to explain what they are doing to fix this.|huh

I would like to see a list of sponsors that have made an effort to fight this theftware.

heywood

2006-10-28, 03:55 PM

It's attached to my post on the previous page of this thread.

Awesome, thanks man!

Its nice to see a lot of us banding together on this effort, it helps everyone in the long run (well everyone except scumware companies).

MightyMidget

2006-10-29, 12:29 PM

Hey zman, nice script!
Haven't tried running it but I know that taskkill is not available for Windows XP *Home* Edition (and probably not for Windows versions before that either). Which means it won't work for most surfers and they'll end up getting a "not a valid Win32 program" - message.

pskill might be an option though it means you'd have to include it in the zip
http://www.sysinternals.com/Utilities/PsKill.html

Also, you might wanna add the "/-p" parameter to your dir commands in case the user has the DIRCMD variable set.

zman

2006-10-29, 03:05 PM

Hey zman, nice script!
Haven't tried running it but I know that taskkill is not available for Windows XP *Home* Edition (and probably not for Windows versions before that either). Which means it won't work for most surfers and they'll end up getting a "not a valid Win32 program" - message.

pskill might be an option though it means you'd have to include it in the zip
http://www.sysinternals.com/Utilities/PsKill.html

Thanks for pointing that out. I can easily integrate pskill into the batch file.

Also, you might wanna add the "/-p" parameter to your dir commands in case the user has the DIRCMD variable set.

The DIR command does not work that way with the /-p parameter. I'll just set the DIRCMD variable to nothing like this: set dircmd=

Thanks

Jim

2006-10-31, 12:15 PM

The whole program or script thing is tough. I found out yesterday that if you are not using a particular brand of windows or your PCs directory structure is not setup the same, it just won't work correctly.

I am almost thinking of educating surfers on the benefits of cookies and possibly suggesting a good anti-adware program. Of course, I will not change any pages. I may add a page with that suggestion and offer it to anyone that wants to use it. So far, the only way to get rid of this is to follow the instructions to the letter.

I think it may be just too big of a job to make a script and/or program that will work for all surfers suffering from this scumware.

Jim

2006-10-31, 12:17 PM

But please, since I am no programer, if anyone has anything that will work with everyone, let me know.

EzRyder

2006-10-31, 12:26 PM

Since I am a simple person, I may be over simplifying a bit, but if as I understand correct, Spybot Search & Destroy(I don't think it kills cookies) checks for Zango and a kazillion other scumware types why not just put a link as to where the surfer can download and install?

I only use SS&D as an example. There are probably other scanners that might do the job.

Ok, now I am ready to hear the faults in my thinking. :-)

I am concerned about this plague, but I am not astute enough to offer any real solutions.

virgohippy

2006-10-31, 04:04 PM

Greenguy

2006-10-31, 04:14 PM

I've used and suggested SS&D for a few years now. I haven't heard, or experienced any problems with it either. However, things may change in the future, and relying on someone else's program to do only the specific task you intend is a bit of a risk. That being said, I wouldn't have a problem directing surfers to a page that links to SS&D. :)

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

ChiTown

2006-10-31, 04:33 PM

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

Getting rid of it isn't that much of a prob, and blocking the IP
for the actual download isn't that hard either, block 66.152.93.119
with your firewall and you'll never get the XXXtoolbar, block
216.130.187.150 and you'll never get the isearch toolbar for example..

When Zango was LoudCash before 180Solutions bought
them U.S. prosecutors charged Jeanson James Ancheta of
Los Angeles,as well as an unnamed co-conspirator,that they
used a botnet to disseminate and install adware from
two firms: Loudcash and Gammacash!
Enter once again Gammacash!!!
|yawn|

EzRyder

2006-10-31, 04:36 PM

I certainly understand you folks not wanting to come off as trying to make $$$ off of this. The Spybot thing is freeware and I'm sure others are also. There is a donation page on the SS&D website but it is an option not a mandatory thing. It was just an example I chose to use.

For Mr/Ms Surfer to edit their Registry is kind of scary tho. Heck, when I have done it, it makes me a bit shaky and I started in the computer biz back in '62. 1962 not 1862 a some would have you believe. ha!

Some time, someday someone will come up with a cure. I'm almost positive of that.

virgohippy

2006-10-31, 04:47 PM

The problem is that Jim (and I) don't even want to appear that we're making money off of this, so by sending them to a program that costs money, it'd come off as a scam.

I understand the importance of credability in this situation, and I completely agree. It's important to keep the surfer's trust through all this.

But I believe SS&D is free to use and download, though they will accept donations. Tis why I agreed to the use of SS&D. :)

Would it be possible/easy to have two pages side by side, one that links to a single, suggested program, and one that's completely clean? It should be easy enough to pass a single argument through the url, make it switch between different types of content... but keeping track of that content is more work.

I know I wouldn't have a problem directing surfers to a site that links to SS&D, but I'm sure not everyone feels the same way.

Greenguy

2006-10-31, 05:03 PM

...Would it be possible/easy to have two pages side by side, one that links to a single, suggested program, and one that's completely clean? It should be easy enough to pass a single argument through the url, make it switch between different types of content... but keeping track of that content is more work...I'm not sure we'd (Jim) would want to do that at this time, but feel free to set it up like that on your own domain.

All we're (Jim) doing is giving people the option to use the page on our server, but you can easily set it up to go to a page on your domain as well :)

zman

2006-10-31, 05:09 PM

The whole program or script thing is tough. I found out yesterday that if you are not using a particular brand of windows or your PCs directory structure is not setup the same, it just won't work correctly.

The PCs directory structure does not need to be set up in the standard way (C:Windows; C:\Program Files; etc.). The script I wrote is pretty simple but it does search for zango executables and dlls, unregisters and deletes those files. It also deletes known zango registry entries and zango cookies. I've made some minor changes since I uploaded it and I've also integrated the free process kill utility from symantec because as MightyMidget said the taskkill command is unavailable in Windows XP Home Edition. But the script still does not work under Win95/98/ME.

I am almost thinking of educating surfers on the benefits of cookies and possibly suggesting a good anti-adware program.

Of course the easiest and most effective way would be to recommend to the surfer a commercial adware/spyware remover, but as Greenie said they might think we want to make money off them.

So far, the only way to get rid of this is to follow the instructions to the letter.

My script does the same thing with a double-click of a button. I'll email you Jim with the latest version to your GGJ mail address. I've tested it out on quite a few computers and it worked fine. If it still has some flaws I should be able to make a few improvements.

I think it may be just too big of a job to make a script and/or program that will work for all surfers suffering from this scumware.

Well it's not easy but it can be done. I believe it might take a week or so to write a good remover that will work under all Windows OS's. The software should also be easy to adapt to new scumware like zango.

virgohippy

2006-10-31, 05:13 PM

I'm not sure we'd (Jim) would want to do that at this time, but feel free to set it up like that on your own domain.

All we're (Jim) doing is giving people the option to use the page on our server, but you can easily set it up to go to a page on your domain as well :)

I was just trying to look out for the webmasters who aren't as geeky as me. ;)

But you're right, now that Jim has shown the way, I could easily build my own set up. :)

Thumb Angels

2006-11-01, 03:54 PM

I would rather use an own page, easier to keep track of how many it really is then :) I send around 6-700/day to my page from my sites

Greenguy

2006-11-01, 04:13 PM

I would rather use an own page, easier to keep track of how many it really is then :) I send around 6-700/day to my page from my sites

Not that I want to sway anyone away from doing it themselves, but if you use the css option & send it to adwaresucks.com, you can tell how many hit the page each day by how many times the css file was loaded.

Jim

2006-11-03, 01:54 PM

You guys would not believe some of the crap I have learned over the past couple of days. A person that has been fighting zango for almost 3 years contacted me and he has taught me a lot about zango. These guys are some of the most devious we have ever been up against. The crap they are doing with cookies, iframes and even javascript is crazy. We have barely touched the surface with the popups. But, some of the stuff they are doing is illegal. And, they should be going to court in a few days. The illegal stuff may be their downfall... Cross your fingers.

MrYum

2006-11-03, 03:38 PM

Jim

2006-11-03, 03:45 PM

Shit, I just posted a link to cnet saying the same thing. The important part is they have to clearly let the surfer know they are installing pop ups and provide an easy removal tool.

mOrrI

2006-11-06, 05:49 AM

Great stuff...
thanks for sharing this with us...

mist

2006-11-19, 05:45 AM

Thanks for the htaccess file.

eman

2006-11-19, 02:07 PM

http://www.vnunet.com/vnunet/news/2167402/campaign-targets-zango

Zango spokesperson Steve Stratz called the Zango Warning site "blatant lies and scare tactics", and provided vnunet.com with a copy of an ad that the company will soon be running.

The ad, which is set to appear every time a user is re-directed to the Zango Warning site, tells the user "The Web page in question is designed to 'scare the surfer', as its 'creator' has confessed.

The makers Greenguy and Jim did not return a request for comment.

T Pat

2006-11-19, 02:16 PM

http://www.vnunet.com/vnunet/news/2167402/campaign-targets-zango

|popcorn| good find eman
Makes me proud to be a member of GGandJ |thumb

eman

2006-11-19, 02:18 PM

These zango people are slippery bastards (:

Greenguy

2006-11-20, 12:32 AM

...The makers Greenguy and Jim did not return a request for comment.DAMN SPAN FOLDERS! Not to worry, I know Jim will have a comment for them tomorrow :)

...Zango spokesperson Steve Stratz called the Zango Warning site "blatant lies and scare tactics", and provided vnunet.com with a copy of an ad that the company will soon be running.

The ad, which is set to appear every time a user is re-directed to the Zango Warning site, tells the user "The Web page in question is designed to 'scare the surfer', as its 'creator' has confessed...
I've already come up with a possible solution - assuming they are detecting it based on the domain adwaresucks.com (how else would they be detecting it?) all you really have to do is put it on a different domain.

Each of us is going to have to host it on our own domains. And yes, they'll eventually get a list of domains that are doing it together & pop-up the anti-ad every time a user goes to those domains, but they won't get every domain if everyone uses a different one

Yes, this will take time on our parts & yes, it does seem like work you've already done, but think of the workload they'll have surfing around to all our sites seeing if the ad pops up :D

virgohippy

2006-11-20, 03:43 AM

How about a speedy redirect with htaccess that's set to point to one of many recently designated "info" pages?

Kind of a shame this is turning into a pissing match. As they adapt, we're forced to do so. Seems to me fighting with these people with code, and web tricks seems like a battle of wasted efforts. We need to fight them on a level on which they can't easily compete.

Find something in their documentation and harass them legally through the judicial system... maybe even a class action lawsuit for stolen revenues?

Jim

2006-11-20, 06:22 AM

Holy Shit..I was never asked for a comment about what any zango spokesman said. Maybe Sparky can come up with some way to stop their warning from blocking our warning :) I do have to wonder, what lies did I say in the warning? I quoted Zone Alarm and I said that what zango was doing was not illegal since the user agreed to it in their terms and conditions. Maybe that was the lie :)

Jim

2006-11-20, 06:32 AM

Senator_x

2006-11-20, 09:38 AM

I would like to collect stats on my server to see how many surfers are infected with ZANGO. There must be an easy way.

Greenguy

2006-11-20, 09:44 AM

I would like to collect stats on my server to see how many surfers are infected with ZANGO. There must be an easy way.
You could use the htaccess code that we have, redirect it to a copy of your main page on your server & see how many people have it by watching the stats for the mirror page.

Greenguy

2006-11-20, 09:46 AM

Holy Shit..I was never asked for a comment about what any zango spokesman said....Sparky looked thru the log files last night & no email from vnunet.com came thru the servers in the last 2 weeks.

I think you need to write them a strongly worded letter!

Senator_x

2006-11-20, 09:48 AM

You could use the htaccess code that we have, redirect it to a copy of your main page on your server & see how many people have it by watching the stats for the mirror page.

That was easy.

Thank you

Greenguy

2006-11-20, 09:50 AM

...Zango spokesperson Steve Stratz called the Zango Warning site "blatant lies and scare tactics", and provided vnunet.com with a copy of an ad that the company will soon be running.

The ad, which is set to appear every time a user is re-directed to the Zango Warning site, tells the user "The Web page in question is designed to 'scare the surfer', as its 'creator' has confessed...OH! I thought of another possible solution for this - on the adwaresucks.com page, where they will be popping up the anti-ad, we can add some text along the lines of: "The pop-up you just saw is proof that Zango is tracking where you are surfing - how else would they know that you were on the our website? Please read......"

Jim

2006-11-20, 10:15 AM

I really hope that when we see what they have done, Sparky will come up with an answer for us. Like I just told Greenie, they could have something as easy as if the word zango is on a page, they popup the window calling me a lier using scare tactics. Since they have included themselves on their exclusion list, they really don't want to use their browser when zango is mentioned anyway. I think we have to fight this with software and not just moving it. But, if we could pop somethig on top of their popup like Greenie mentioned that might work as well.

Jim

2006-11-20, 10:16 AM

Oh yeah, anyone redirecting to the adwaresucks page...if you would like to know how many surfers you have sent, just ask me and I will let you know.

tickler

2006-11-20, 10:44 AM

Hey Jim, you could always put an looping auto-focus on your page to bring it to the top. Even if they do the same it will drive the surfers nuts with the page flipping.

Find something in their documentation and harass them legally through the judicial system... maybe even a class action lawsuit for stolen revenues?
Well here the details direct from MetricsDirect(Zango) page on how they deliver ads.
http://www.metricsdirect.com/whatwedo/deliveringyourads.aspx
"a woman types in “women’s discount shoes” on Google. Google delivers a page with its usual list of search results and sponsored listings. Zango delivers a new browser window above this listing, displaying the advertiser’s landing web page."

Jim

2006-11-20, 12:30 PM

Oh yeah, anyone redirecting to the adwaresucks page...if you would like to know how many surfers you have sent, just ask me and I will let you know.

I forgot that since we are sending traffic using an htaccess file, I am only able to see the sites that send traffic to you. The numbers are crazy. So far for the month of November, that page has gotten 153434 visits. :)

[BV]

2006-11-20, 04:50 PM

I have run across a couple neat tools to combat Zango on other boards.

Is it ok to link to threads on other boards?

One is a one click zango removal tool and the other is some code that can be placed on the page to prevent Zango from popping an add.

Greenguy

2006-11-21, 09:23 AM

BV - post away!

tickler

2006-11-21, 12:30 PM

I've already come up with a possible solution - assuming they are detecting it based on the domain adwaresucks.com (how else would they be detecting it?) all you really have to do is put it on a different domain.

Each of us is going to have to host it on our own domains. And yes, they'll eventually get a list of domains that are doing it together & pop-up the anti-ad every time a user goes to those domains, but they won't get every domain if everyone uses a different one

Yes, this will take time on our parts & yes, it does seem like work you've already done, but think of the workload they'll have surfing around to all our sites seeing if the ad pops up :D
|greenguy| you have a PM with some code to look at! Figured I would let you take a look before I posted it.

Greenguy

2006-11-21, 12:45 PM

Thanks tickler |shake|

monro

2006-11-22, 03:37 AM

Oh yeah...I have a funny story, speaking of zango. Saturday, my daughter brought over her laptop because she has been running without any virus protection. So, I go and search for Pccillan..I forgot the domain. I find it and go to the site. I am about to click on buy and a window pops up with another buy in it. So, I start to move my mouse to it to click and then look at the bottom of the browser. "Browser brought to you by Zango" :)

How does Google and other search engines react to this? As you describe it above it is pure theft! And misleading the search results provided.
-----------
Last 24 hours the amount of Zango infected users redirected by my .htaccess have gone down 50%. Has Zango found a way around the script already you think?
It is "ZangoToolbar" in: RewriteCond %{HTTP_USER_AGENT} ZangoToolbar [NC] i am worried about.
If they change "ZangoToolbar" is it free way for the thieves again?

jayeff

2006-11-22, 07:04 AM

How does Google and other search engines react to this?

I suspect right now that Google & Co are more concerned with click "arbitrage": which is when you locate keywords which are cheaper on Google (for example) than somewhere else (say Adsense), buy them on Google and then redirect visitors to an Adsense landing page, instead of the content they imagined they would reach.

http://adwords.blogspot.com/2006/07/landing-page-quality-update.html

It's good to see a variety of ways emerging with which to combat Zango. I just hope people don't lose sight of the reality that Zango is only one scumware company out of many and that most of the solutions to date don't offer a way to recover the income we potentially lose to scumware, because the infected surfer still cannot reach the targets we intend him to reach.

We should protect our sites to the maximum extent possible, but we also have to increase the pressure on our industry to adopt professional standards. The scumware issue surely illustrates that "ethics" is not just an abstract concept which must always play second fiddle to making money. By definition, scumware only allows a small number of people to profit while everyone else is effectively mugged and the whole of the estimated $20 billion a year which the scumware providers make is being scrubbed off affiliate and sponsor profits, because they do not create sales, only divert them.

tickler

2006-11-22, 08:54 AM

.....small number of people to profit while everyone else is effectively mugged and the whole of the estimated $20 billion a year which the scumware providers make is being scrubbed off affiliate and sponsor profits, because they do not create sales, only divert them.
Since 99.9% of the internet is advertising driven, how long before affiliate programs start collapsing. Advertisers wrongly paying out on type-ins, affilates sales getting ripped off, search engines getting mugged on PPC revenues. |club|

How many people are going to create, and filter traffic if there is no money to made? Time, content, bandwidth, hosting all cost $$$s.

Greenguy

2006-11-22, 09:53 AM

...Has Zango found a way around the script already you think?
It is "ZangoToolbar" in: RewriteCond %{HTTP_USER_AGENT} ZangoToolbar [NC] i am worried about.
If they change "ZangoToolbar" is it free way for the thieves again?
I just asked Sparky if he knew of a way for them to change the user agent on existing installs.

And if they do, we'll just have to change some things & look into building a better system :)

cd34

2006-11-22, 11:22 AM

While I am reasonably sure that Zango has the programming capabilities to do an auto-update, I wonder what the long term effect is. Its possible that new generations have a different identifier and older generations still bear the Zango tag.

Here's the cynical view I see of Zango.

Affiliates push a sponsor, Zango skims that sponsor and takes a % for themselves. Affiliate leaves sponsor because conversions suck. Zango no longer has anything to skim.

The long term model only works when Zango (or any scumware vendor) is able to skim traffic filtered enough to go to paying locations. It doesn't make sense for zango to pop an advertisement for Hawaiian Air when someone is surfing a site on pet adoption. Which means that they need to do context sniffing to present reasonable ads. Right now, they can target simple URL strings which doesn't require much computing power or intelligence.

If everyone knew that SponsorA was buying clicks to advertise above SponsorB, and everyone stopped advertising SponsorB because of lower conversions, it seems that somewhere along the line, SponsorA, Zango, SponsorB and the affiliate lose out.

A sponsor that is being Zangoed, sees the same number of signups, the same relative payout -- just that the distribution to the affiliates has changed.

The problem I have with most of the tried and true detection systems is that to detect scumware, you almost have to be scumware. As for zango displaying a message on top of adwaresucks.com, it just shows that they are scared that people might learn what has been installed on their machines.

tickler

2006-11-22, 06:58 PM

A sponsor that is being Zangoed, sees the same number of signups, the same relative payout -- just that the distribution to the affiliates has changed.
The sponsor may also end up doing payouts on typein traffic. So much for viral marketing, or URL stamping as discussed in another thread.

[BV]

2006-11-22, 11:18 PM

Zango is not the real problem, the retards that buy traffic from them are.

Dealing in stolen merchandise.

If no one bought traffic from Zango then they would have to send traffic to sponsors themselves. Maybe they do that now, i don't know. If that was the case I (sponsor) would kill their account.

I've canned a few accounts when I don't like what I see.

If every sponsor did that, think how much better it would be.

When you see an affiliate doing something you don't like, can their ass!

This is the only way we can solve the problem because today it's Zango, tomorrow will be someone else, and so on.

~BV

monro

2006-11-24, 04:56 AM

I do think the Zango issue is worse than we can ever image. A friend called me the other day as he is running a Internet based training school and buying ad spots at Google. As it is a small market with high competition he has to pay a lot for every link hit. After hearing this, I went to Zango and bought his domain name as a keyword. No problem! ( Did not pay )
So, he pays Google and a competitor get the customer! I do hope someone at Google realize this thefts very soon! We have written a company letter to them, as emails are of no use to contact the bigger ones!

monro

2006-11-24, 04:59 AM

The thief going home after work. (http://i10.photobucket.com/albums/a124/exclusive_1977/Zango.jpg)

Mish

2006-11-28, 02:59 PM

This is a GREAT post.... thanks Jim for booting that annoying guy so you guys could get back to business!

I've been trying to follow the whole Zango situation as best I can considering I am not on the technical side of the biz....

In my research, I came across this site - any idea who's behind it?

http://www.zangoblacklist.com/

monro

2006-11-29, 09:45 AM

If you have mailto:yourcompany@yourserver.net on your pages and a surfer having Google toolbar installed without modifications, he will be redirected to Google G-mail! Not to you! How many sales have you lost, do you think? Install Google toolbar and do a test!

It's hopeless, Internet will be a mess, all those criminals fighting each other to get our surfers!

By the way, I'm banned from GFY now. I was fighting AFF and Zango hard there. Reason? They said that I was blaming AFF without any proof!!
( I called the Zango use for shaving and theft )
Nice. But the funny thing is that I wrote early there (at gfy) that I was expecting to be banned. There are to many on that board doing the same thing as AFF. Now are all Zango And AFF blamers quiet at GFY! Afraid to be banned I assume.

LadyNorth

2006-12-06, 02:30 PM

So, any news about Zango? Have not heard anything for a while.

Lot

2006-12-06, 03:39 PM

Great thread! Thx Jim for your updated info about the court case!
I knew about the things these guys make by the means of Zango and i'm glad they are stopped!

LadyNorth

2006-12-15, 04:47 AM

Just heard that Zango with their new version has found a way to get around our efforts to keep them out. Do not know if it is true. Anyone else heard anything about it?

LadyNorth

2006-12-15, 10:15 AM

Yes just tested with a Zango infected PC and yes, they have come up with something, because we were re-directed directly to AFF without our affiliate code. Anybode else?

monro

2006-12-15, 11:19 AM

It's going to far!!!!

Today I installed Zango at another computer and tested my own sites as I saw AFF traffic went down as well as the amount of zango surfers caught by my .htaccess.
I have the following .htaccess file installed:
----------------
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} zango [NC]
RewriteRule ^$ http://www.sexyads.net?rs=398&rc=zango1 [R]
----------------

On every AFF link clicked, another page show up without my affiliate codes shown. They where stolen, just like that!

Please help!!!!

***************
To make me compleatly mad this zango thing popped up when entering this forum:

This ad is served by Zango. It has been delivered for two reasons. First, you are a Zango consumer who knowingly and willingly installed our desktop advertising software onto your computer in order to access a large catalog of entertaining and useful online videos, games, music, tools and utilities. Much like television, this content is funded by advertising and is therefore free of charge to you, the consumer. Second, because all our ads are delivered by keywords, much like ads displayed in search engine results, we are able to anonymously target this specific ad to Zango consumers who have initiated some relevant connection to the Web page www.adwaresucks.com/zango/.

This ad – our ad – responds to some of the most blatantly false accusations on that page and provides you, our valued customer, with Zango’s side of the story.

Point one: Your computer is not “infected.” The Web page in question is designed to “scare the surfer,” as its “creator” has confessed (and as is probably obvious from the huge red lettering and the over-the-top nuclear radiation symbol). You, the consumer, control your PC. We at Zango have gone to great lengths to ensure that every consumer who installs our software sees, prior to installation, a fully and conspicuously disclosed plain-language notice and consent process. In addition, this process and subsequent messages and reminders all include a link for more information about Zango, including uninstall instructions.

Point two: We do not monitor your computer activities, period. Our foremost concern is for the privacy of our customers. We are committed to protecting that privacy; Zango’s desktop advertising software does not collect personally identifiable information. Ever.

Point three: We strongly “believe in your right to be informed,” but being informed requires access to fact and reality, not innuendo and scare tactics. Here’s fact and reality: Today, 200,000 consumers just like you will make the informed choice to install Zango and join our network of more than 20 million users worldwide in order to access more than 100,000 pieces of free digital content across the Web. They do so in exchange for viewing targeted advertising while anonymously searching or browsing Web sites.

We are committed to safe and ethical Best Practices and take a number of steps to notify consumers as to what our software does, how it works and how to easily uninstall Zango. To learn more about Zango or to contact us, visit www.zango.com.

Don’t like Zango? Uninstall the software. But do so only because you’ve decided to take that action after weighing the advantages and disadvantages – a calculation you can’t make based on scare tactics and misinformation. Millions of people use Zango everyday to access online videos, games, tool and utilities. We trust that you value our offering and hope that we can continue to be your online media company of choice.

monro

2006-12-25, 02:28 PM

OK, I was banned from GFY for fighting AFF - Zango "I had no proof!"
If you enter this thread with Zango installed a big popup appear defending Zango. See above. But: Why is it so quiet about AFF - Zango attacks?

Aff - Zango are worse than ever, pops up everywere, some sponsors are losing traffic now.
And, worst of all, AFF and Zango try to stop criticism. See Screenshot below covering a board where AFF and Zango are heavily discussed.

http://i10.photobucket.com/albums/a124/exclusive_1977/dateboard.jpg

OBS! As you can see it is a Mozilla browser used with no Zango toolbar installed. Explorer with Zango tollbar is installed but not started in the test computer. And the language used in the popup switch depending on which country you come from. That for privacy!!

The sponsors, where their landig pages forums and affiliate login are covered by AdultFrienFinder - Zango popups, increase daily. Some are spared, you can maybe guess why?

RamCharger

2006-12-27, 08:20 AM

tickler

2006-12-27, 11:37 AM

Is zango still alive and kicking? I thought this was all done after they got nailed in court or is this whole thread about dealing with people who have a now obsolete software package? All the news articles that I see pretty much show that they've been hammered into practical non-existence (http://news.google.com/news?hl=en&ned=us&q=zango).
That hit was for the auto-installs. The rip-off side hasn't been addressed directly yet!

I'm really disappointed that I haven't seen any sponsors come forward on this issue yet.|confused|

monro

2006-12-28, 04:15 PM

I wrote this in the Google Community but no one has responded yet.

"Theft from adwords
Theft of adwords paid clicks.
It's scum ware out there called Zango. At Zango it is possible to buy urls. Example: www.google.com. I tried to buy our own link, the one we pay for at Ad Words, and it was no problem! I tried to buy a competitors domain name as well, still no problems! In other words, you pay Google for the link hits and another person gets the visits! We wrote a letter to Google about this, but no answer. Zango has over 20 million users now and adding 200.000 new every day. It works like this: The surfer clicks your link and your page opens. But your page is covered by another page delivered by Zango. This page belongs to the highest bidder at Zango. So, if you want your page to show, you have to pay twice, first to Google, second to Zango. Zango is destroying the affiliate system as well. One example: Someone can buy the domain name www.amazon.com at Zango, and get every sale from an affiliate having a link to amazon.com! The affiliate code is changed to the highest bidders own.
The only ones with a chance to stop Zango thefts is Google and other search engines. Ban all advertising of Zango! Put all bidders at Zango in the sandbox! This is the last chance to save the whole adwords and affiliate system. So, now I'm going to bid on amazon.com at Zango and I have all possible sales from 2.000.000+ users in a box! I'm rich in no time!"

ForestL

2006-12-28, 05:04 PM

way to go guys

zack2004

2006-12-28, 06:13 PM

As long as the sponsors are using this scumware they will stay in business.
I don't understand why a company would want to screw their own affiliates. Soon they will only be getting seach engine traffic and paying for it twice http://xbiz.com/news_piece.php?id=17675 |crazy|.

sabin

2006-12-30, 09:54 PM

Is there a list of affiliates that are using Zango that I can boycott?|huh

Mutant

2007-01-26, 03:13 PM

Here is the url for the page I created...
http://www.adwaresucks.com/zango/

Hi Greenie
1st i would like to thank you for listing my first freesite so quickly.

I just found this "ZangoToolbar" in my logs (visitor came from fuckingbeaver), so i made a search and here i am.

About your zango page:
As a surfer i'm totally immune to this type of warnings, because i've seen too many of them that were just lying about the infection and advertised some other potentially dangerous software.

I have some experience with manually removing malware so i know what your page says but if i was a silly internet newbie my first thought would be "oh shit ! someone hijacked linkorama and replaced it with his page ! and he wants me to fuck up my computer !"

What would make this page more trustworthy ?
IMHO: REFERENCES !!!
You can link to zango page on Wikipedia (http://en.wikipedia.org/wiki/Zango), to some free adware removal tool for computer challenged people and maybe even to a search on googlegroups (http://groups.google.pl/groups/search?hl=pl&ie=UTF-8&oe=UTF-8&q=%22zango+toolbar%22).

Mutant

2007-01-26, 03:29 PM

more
I think it would be a good idea to tell infected surfers how it was possible to discover the infection by showing them all of their info (ip, country, user agent etc) like this page does (http://sharkideas.com/zango-test/).
Silly internet newbies think that they are 100% anonymous - they think that it is impossible to detect adware without running some adware removal app.

TopbucksTrixxxi

2007-01-27, 09:59 AM

Greenguy

2007-01-27, 10:11 AM

Just so everyone knows, Jim will be working on a better mousetrap in the coming weeks.

We're on their radar - and it sorta sucks because as soon as Jim comes up with a new idea, it's kinda hard to hide it from them while posting it here on the board so that people can know aobut it :D

But last I heard, new measures were in the works & programmers were being contacted |thumb

monro

2007-01-27, 02:14 PM

monro, if you still have it installed, can you show me a screencap of what it looks like with their popover warning that it's 'scare tactics'?
I'd appreciate it - I want you to send it to the email I'm going to send you on PM. Thanks!

The pop up is gone now. Ask Greenie about a screenshot. Zango is worse than ever, no wonder with all spineless people around.

If you use the Zango trap in .htacces you will have zango pop up's all over. Remove it ASP. They won.

Not a word about that here! Fighting Zango is dangerous. They have support everywhere. I got banned at GFY for fighting AFF-Zango.
At our forum at sexyads, ( webmasters only with login ) Aff-Zango is popping up after we started a thread fighting Zango.

Smoking Dawn

2007-01-28, 10:37 PM

Very nice info..thanks

ClickBuster

2007-03-25, 01:14 PM

I added this to my pages today:

zango_detect.php - PHP file

<?php
if ( stristr ( $_SERVER['HTTP_USER_AGENT'], "zango" ) ):
?>

<div id="zango_warning" style="font-family:Arial, Helvetica, sans-serif; font-size: 23px; color: #FFFFFF; background: #f0310b; padding: 10px; width: 600px; position: absolute; left: 50%; top: 50%; margin-top: -38px; margin-left: -300px; z-index:9999; text-align: left;">
<a href="javascript:;" onClick="javascript:document.getElementById('zango_warning').style.display='none';" style="font-size: 11px; color: #fff; float: right; text-decoration: underline;"><strong>close</strong></a>
<strong>WARNING: </strong>Your computer is affected with Zango<br />
Learn how to <a href="http://www.adwaresucks.com/zango/" style="color: #fff; font-weight: bold; text-decoration: underline;" target="_blank">completely remove it from your PC</a> </div>

<?php
endif;
?>

and I also added this to my domain root folder's .htaccess file:

php_value auto_append_file "/path/to/zango_detect.php"

Of course you should replace /path/to/ with the actual path to your script. A few notes:

This won't work if a the loaded PHP script (http://site.com/page.php) has executed one of those:

exit;
exit();
die();

I'm sure you get the picture.

You could auto_prepend_file the script, but it will crash if you have a header("anything") or setcookie() - i.e. if you modify the HTTP headers.

It's a lame ass solution, but it has a close button on it, it works on almost every page without modification, it's save script/HTML wise and it still allows your surfers to see your content. That way poor surfers who have no idea wtf is going on won't be redirected, even tho nobody's using Zango to advertise on your pages.

ClickBuster

2007-03-25, 01:16 PM

If you have Zango installed or if you can modify your browser to send a user agent name that has the word "zango" in it (case insensitive), you should see a red warning here:

http://www.nudemenblog.com/blog/