GreenguyandJim Fighting Zango

[darksoul]

Originally Posted by Jim

darksole, you are right...I am a theif. CD34 knows nothing about server software, Greenguy is an uneductated ass and guess what???

You are gone...

easy way out.
you should've applied it from the beginning.

[Jim]

ooops, squeeked a post in before I got to the ban button.

[MrYum]

Originally Posted by darksoul

well,
Are you so keen on what you did that even if its broken you want to keep it ?
I offered you the easy fix, and this cd guy which I assume is your coder
comes to prove he has no understanding of what he does.

You can apply my fix from above, or make your own fix but don't persist just for the sake of it.

Wow...having read through this exchange...someone had a big bowl of cranky flakes this morning.

Darksoul, obviously you don't know these guys. Greenguy, Jim and cd34 are some of the most honest guys you'll come across in this business. IF their idea had originated from your post, you can be damn sure they would have given you the credit that you so desperately desire.

[Useless]

I just hope that someone is going to give credit to whomever the original .htaccess coders/inventors were - or else they're going to be pissed!

darkassoul

[Jim]

The thing is, I have no doubt that a bunch of people came up with the same idea around the same time. I invented nothing...all I did was spend 2 minutes writing the page and asked Sparky for an htaccess file that worked. Pretty much you guys saw my thought process in the other thread.

I didn't surf gfy one day looking for the latest pictures of cars they wished they owned and claim they do and stumble on his post.

As a matter of fact, boardtracker told me that there was another post about me on a different board. I went to read it and saw that it was copied from gfy. So, I went to gfy to explain how it all worked and even thanked the people saying good job. If I stole it from someone posting on gfy, I wouldn't go anywhere near there.

I have no idea why I am explaining it to you guys. You know the truth and I guessed the guy lost all credibility when he said Sparky didn't know what he was doing. That is, if he didn't from his second post.

Good to see you Useless

[EzRyder]

Does it really matter who thought of what first? The idea in the beginning was to combat something that has been going on far, far to long.

"why can't we all get along?" sort of a quote from someone but CRSis kicking in and I can't remember who?

[Jim]

Originally Posted by EzRyder

Does it really matter who thought of what first? The idea in the beginning was to combat something that has been going on far, far to long.

"why can't we all get along?" sort of a quote from someone but CRSis kicking in and I can't remember who?

I tried by letting him know if he wanted to help we would welcome it.

And your quote...I keep thinking, Larry King Someone King, I know that much

[Simon]

Maybe you mean Rodney King?

"People, I just want to say, you know, can we all get along?"

Surely don't want to misattribute anything in this thread.

[Jim]

Originally Posted by Simon

Maybe you mean Rodney King?

"People, I just want to say, you know, can we all get along?"

Surely don't want to misattribute anything in this thread.

You mean it wasn't Larry King?

[MightyMidget]

Hehehe, just too funny... That guy's got the attitude of a warez d00d or cracker with his phearsome sKillZ, so good riddance

[virgohippy]

Originally Posted by mniki

Sorry to interupt discussion

It may sound like stupid question but I am not very good at this.
Need explanation about htaccess, Under same domain name have TGP and LL. Would It be enough to put It In public_html folder of my domain name or should I put separatly htaccess 1 for TGP and 1 for LL.

Looks like your post nearly got lost in the .

htaccess gurus, correct me if I'm wrong

I think it depends on how you have your dir structure set up. If you have an htaccess file in a folder it is considered a replacement for any htaccess files closer to the root domain.

If you have an htaccess file in the following:
yourdomain.com
yourdomain.com/dir1/

The htaccess file at the root (yourdomain.com) will not affect anything inside dir1, however it will continue to affect:

yourdomain.com/dir2/
yourdomain.com/dir3/

The htaccess file in dir1 will affect anything deeper than dir1:

yourdomain.com/dir1/subdir1/
yourdomain.com/dir1/subdir2/

htaccess is an all or nothing deal. If it's affecting dirs, then it's affecting them. If it's not, then it's not.

Does that answer your question?

[cd34]

Virgohippy's explaination is correct, however, you can add

RewriteOptions inherit

in an .htaccess that is below a parent .htaccess and it will use the rules from both.

So, you could set up your main rules in yourdomain.com/.htaccess, and add additional rules in yourdomain.com/dir1/ with the

RewriteOptions inherit

And the files served in /dir1/ would utilize both.

[Linkster]

Cant we all get a long? - Hmm I always thought it was Cant we all get a long neck:

Oh, why can’t we all just get a long neck?
And make a toast to peace and harmony
Why why cant we all just get a long neck?
See how good gettin’ along might be

I’d like to buy the world a round
In a honky tonk on neutral ground
Where we can see inside we’re all the same
Pop a top and let the good times pour
‘Til we forget what we’re fighting for
I’ll ask again could someone please explain?

Hank Williams Jr

Course it may just be where I live since I know Guttermouth did a song similar to this

[mniki]

Thx virgohippy and cd34 for help and explanation

[Quick Buck]

Jim,

Don't you think it would be more effective to display a dhtml popup than to redirect the surfer?

I mean sure, greenie only sees .15%, but some people probably see 10% and that means they'd be sending 10% of their surfers to another site... now i'm not saying that it's bad to tell people they have zango, but the way zango works, a user only gets a pop every hour or two, so the odds of them popping a new browser on your page is actually very small if the surfer is navigating link lists and tgp's because they are likely hitting 10's or hundreds of domains.

I would think that a dhtml ad would be more effective because the user could close it if they wanted.. your method seems like (unless i'm misunderstanding it) that it redirects every zango surfer away from the site.

This could be done easily with some javascript.

[zman]

Hey QuickBuck,

Zango does not work that way.
If the surfer has Zango installed even if he types in the url manually in IE 6,
Zango changes the HTTP_USER_AGENT from MSIE 6.0 to ZangoToolbar.
There's no need for Zango to popup a new browser window to be detected.

[tickler]

An additional thought about dumping all Zango users, and it ties in with a comment I made about how sponsors should only red flag sales showing the user_agent and then investigate the referring URLs.

The surfer can still buy a membership, and the right WM would still get credit: If the link/keyword has not been sold by Zango.

As far as the low number of surfers being detected, remember that a lot of these installs where done for other reasons than porn, like games/musics/etc. So a lot of the infected computers may never hit a porn site.

[Danielle]

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

Hugs,
Danielle

[zman]

Originally Posted by Danielle

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

Hugs,
Danielle

I wish I would have an answer for you

[virgohippy]

Originally Posted by Danielle

What happens if Zango quits changing the HTTP_USER_AGENT? How would you detect it then? Just thinking out loud.

No solution here, but a concern to go along with this whatif: I'd be wary of any solution that promotes a script/program that invades the privacy of a surfer's system. Anything more than detecting HTTP_USER_AGENT could start pushing things in the wrong direction...

[babymaker]

well i applaud the effort and it's nice to see action taken I have to say if i was zango, i would just take a few keywords off the landing page and put a system wide ad to pop a spyware removal site or any porn site etc and grab all that traffic back....................

[zman]

I've made quite a bit of research the last couple of days and this is what I came up with.
It's a batch file I wrote which is intended to totally remove Zango from the surfers computer.
It basically does the same thing as Jim's tutorial says plus a few things like removing Zango start menu shortcuts,
Zango cookies, windows prefetch data and all the registry entries I could find were created by it.

@echo off
cls

set TMPF1=%TEMP%\dzf.tmp
set Prefetch=%WinDir%\Prefetch

echo 1. Terminating known Zango processes.
taskkill /f /im "zanu.exe" /im "zango.exe" > nul 2>&1
echo.

echo 2. Searching for and unregistering Zango DLL's.
for /r "%ProgramFiles%\" %%i in (*zangohook.dll *ZbAds.dll *ZbCoreSrv.dll *ZbHostIE.dll *ZbToolbar.dll) do (regsvr32 /u /s "%%i"
echo    "%%i" - OK)
echo.

echo 3. Locating and deleting Zango files and folders.
echo    This may take a while... Please be patient.
if exist %TMPF1% del %TMPF1%
pushd %ProgramFiles%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (
dir "%%i\" /a-d /b >> %TMPF1% 2> nul
rmdir /s /q "%%i\")
echo    %ProgramFiles%\ - OK
popd

pushd %AllUsersProfile%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (rmdir /s /q "%%i\")
for /f "delims=" %%i in ('dir /a /b /s ^| find /i "zango"') do (del /f /q "%%i")
echo    %AllUsersProfile%\ - OK)
popd

pushd %UserProfile%\
for /f "delims=" %%i in ('dir /ad /o /b /s ^| find /i "zango" ^| sort /r') do (rmdir /s /q "%%i\")
for /f "delims=" %%i in ('dir /a /b /s ^| find /i "zango"') do (del /f /q "%%i")
echo    %UserProfile%\ - OK
popd

if exist %TMPF1% for /f "delims=" %%i in ('find /i ".exe" %TMPF1% ^| find /i /v "%TMPF1%"') do (
del /f /q "%Prefetch%\%%i*" >nul 2>&1)
del /f /q "%Prefetch%\*zango*" >nul 2>&1
del /f /q "%TMPF1%" >nul 2>&1
echo    %Prefetch%\ - OK
echo.

echo 4. Cleaning up known Zango registry entries.
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "zanu" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "zango" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zango TvTimes" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZangoToolbarWebTools" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{21B4ACC4-8874-4AEC-AEAC-F567A249B4D4}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{7B178417-3CDA-444F-94FF-312C0A3A78A8}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{68BF4626-D66B-4383-A6AF-62E57E9B6CD4}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\TypeLib\{E5B57AB3-15F8-43A2-ABAC-3E58A9C25818}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ncmyb.SABHO" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Classes\ncmyb.SABHO.1" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jade Shadow" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zango TV Times" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\zanu" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\ZangoToolbar" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\zango" /f >nul 2>&1
reg delete "HKLM\SOFTWARE\zanu" /f >nul 2>&1
echo    HKEY_LOCAL_MACHINE - OK
reg delete "HKCR\ZbSrv.ZbCoreServices" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices.1" /f >nul 2>&1
reg delete "HKCR\Typelib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKCR\Typelib\{DC92EE2E-DF2D-4A80-A48B-17377C81CFC2}" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx.1" /f >nul 2>&1
reg delete "HKCR\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKCR\Interface\{E43DFAA6-8C16-4519-B022-8792408505A4}" /f >nul 2>&1
reg delete "HKCR\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKCR\Interface\{BDDDF1A5-51A9-4F51-B38D-4CD0AD831B31}" /f >nul 2>&1
reg delete "HKCR\Interface\{BD31DF26-7178-41F4-88DD-F16B82D827CA}" /f >nul 2>&1
reg delete "HKCR\Interface\{A16650A9-B065-40EC-BBD1-F8D370D17FB1}" /f >nul 2>&1
reg delete "HKCR\Interface\{89D36231-6BD9-4E20-BBA0-FD28C3A83C40}" /f >nul 2>&1
reg delete "HKCR\Interface\{7FA8976F-D00C-4E98-8729-A66569233FB5}" /f >nul 2>&1
reg delete "HKCR\Interface\{72FEEB09-BB27-46D3-A06D-930D4D544227}" /f >nul 2>&1
reg delete "HKCR\Interface\{6C092742-10FE-4DB2-988D-FC71948DE70C}" /f >nul 2>&1
reg delete "HKCR\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKCR\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKCR\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKCR\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX.1" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices" /f >nul 2>&1
reg delete "HKCR\ZbSrv.ZbCoreServices.1" /f >nul 2>&1
reg delete "HKCR\Typelib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}" /f >nul 2>&1
reg delete "HKCR\Typelib\{DC92EE2E-DF2D-4A80-A48B-17377C81CFC2}" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx" /f >nul 2>&1
reg delete "HKCR\LMgr180.WMDRMAx.1" /f >nul 2>&1
reg delete "HKCR\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}" /f >nul 2>&1
reg delete "HKCR\Interface\{E43DFAA6-8C16-4519-B022-8792408505A4}" /f >nul 2>&1
reg delete "HKCR\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}" /f >nul 2>&1
reg delete "HKCR\Interface\{BDDDF1A5-51A9-4F51-B38D-4CD0AD831B31}" /f >nul 2>&1
reg delete "HKCR\Interface\{BD31DF26-7178-41F4-88DD-F16B82D827CA}" /f >nul 2>&1
reg delete "HKCR\Interface\{A16650A9-B065-40EC-BBD1-F8D370D17FB1}" /f >nul 2>&1
reg delete "HKCR\Interface\{89D36231-6BD9-4E20-BBA0-FD28C3A83C40}" /f >nul 2>&1
reg delete "HKCR\Interface\{7FA8976F-D00C-4E98-8729-A66569233FB5}" /f >nul 2>&1
reg delete "HKCR\Interface\{72FEEB09-BB27-46D3-A06D-930D4D544227}" /f >nul 2>&1
reg delete "HKCR\Interface\{6C092742-10FE-4DB2-988D-FC71948DE70C}" /f >nul 2>&1
reg delete "HKCR\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{F31A5D11-BF0B-4A4E-90AF-274F2090AAA6}" /f >nul 2>&1
reg delete "HKCR\CLSID\{CF1A5756-F372-463E-BC20-1D3D58F4B9AF}" /f >nul 2>&1
reg delete "HKCR\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}" /f >nul 2>&1
reg delete "HKCR\CLSID\{51CF80DC-A309-4735-BB11-EF18BF4E3AD9}" /f >nul 2>&1
reg delete "HKCR\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller" /f >nul 2>&1
reg delete "HKCR\ClientAX.ClientInstaller.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent" /f >nul 2>&1
reg delete "HKCR\ClientAX.RequiredComponent.1" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX" /f >nul 2>&1
reg delete "HKCR\ClientAX.ZangoClientAX.1" /f >nul 2>&1
echo    HKEY_CLASSES_ROOT - OK
reg delete "HKCU\Software\zanu" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\ZangoToolbar" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\zango" /f >nul 2>&1
reg delete "HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser" /v "{5CBE2611-C31B-401F-89BC-4CBB25E853D7}" /f >nul 2>&1
reg add "HKCU\Software\Microsoft\RAS Autodial\Control" /v "LoginSessionDisable" /t REG_DWORD /d 0 /f >nul 2>&1
echo    HKEY_CURRENT_USER - OK
echo.
echo All Done!
pause

I believe it would be much easier for the surfer to double-click a file and get rid of that Zango crap than to manually delete all
those registry entries and files.

The downside of this batch file is that it does not run under Win95/98/Me because some of the commands I've used are
only available under Win2k and later. I've tested this on Windows XP Pro with Service Pack 2 and it worked flawlessly.

If there's anybody out there who could test it on other OS's and let me know I would appreciate it.

[Licker4U]

I believe it would be much easier for the surfer to double-click a file and get rid of that Zango crap than to manually delete all
those registry entries and files.

I agree. Not everyone is going to feel comfortable going into the guts of their computer and deleting files.

[babymaker]

Originally Posted by Licker4U

I agree. Not everyone is going to feel comfortable going into the guts of their computer and deleting files.

i agree on that, you have to remember that these sufers are probably not that internet or computer savy, they voluntarily infected their computers with a "virus" spyware. Unfortunetly, these are also the people who still believe in $1 trial offers lol, and other things like that and probably convert 1:1 lol, so when people think well it's only 2.8% etc, maybe so, but it could be 80%+ of your 1:200 or so conversions.

[virgohippy]

Originally Posted by babymaker

i agree on that, you have to remember that these sufers are probably not that internet or computer savy, they voluntarily infected their computers with a "virus" spyware. Unfortunetly, these are also the people who still believe in $1 trial offers lol, and other things like that and probably convert 1:1 lol, so when people think well it's only 2.8% etc, maybe so, but it could be 80%+ of your 1:200 or so conversions.

Good point, babymaker.

Now imagine how much trust a surfer would develop with a site if that site not only informs them of malicious software on their system, but helps them remove it too... and still gives them free porn samples.