Zango
Threat LevelDamageDistribution

Effects 

Zango carries out the following actions:

• It is executed in the background and it displays information, offers and products according to keywords previously entered by the user while surfing the Internet.
• It downloads and displays advertisements according to the Internet usage habits.
• It creates shortcuts on the Windows Desktop and on the Start menu to the following website:
  
  

Infection strategy 

Zango creates the following files:

• ZANGO in the folder Program files.
• ZANGO.LNK in the Windows Desktop and in the Start menu.
• ZANGOINSTALLER.DLL and ZANGOLIB.DLL in the folder Downloaded Program Files in the Windows directory. These files are DLLs (Dynamic Link Libraries).
• Several files in the subfolder ZANGO, created by Zango in the folder Program Files.

Zango creates the following entries in the Windows Registry:

• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Run
  zango = %ProgramFiles%\ zango\ zago.exe
  where %ProgramFiles% is the folder Program Files.
  By creating this entry, Zango ensures it is run whenever Windows is started.
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ SharedDLLs %windir%/ Downloaded Program Files/ ZangoInstaller.dll
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ SharedDLLs %windir%/ Downloaded Program Files/ ZangoLib.dll
  where %windir% is the Windows directory.
• HKEY_CLASSES_ROOT\ CLSID\ {99410CDE-6F16-42CE-9D49-3807F78F0287}
• HKEY_CLASSES_ROOT\ Interface\ {DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}
• HKEY_CLASSES_ROOT\ TypeLib\ {FF0312E0-F60C-4109-94B8-0A564A58E43B}
• HKEY_CLASSES_ROOT\ ZangoInstaller.ZangoInstaller
• HKEY_CURRENT_USER\ Software\ zango
• HKEY_LOCAL_MACHINE\ Software\ Classes\ CLSID\ {99410CDE-6F16-42CE-9D49-3807F78F0287}
• HKEY_LOCAL_MACHINE\ Software\ Classes\ TypeLib\ {FF0312E0-F60C-4109-94B8-0A564A58E43B}
• HKEY_LOCAL_MACHINE\ Software\ Classes\ ZangoInstaller.ZangoInstaller
• HKEY_LOCAL_MACHINE\ Software\ Classes\ ZangoInstaller.ZangoInstaller.1
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Code Store Database\ Distribution Units\ {99410CDE-6F16-42CE-9D49-3807F78F0287}
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ ModuleUsage\ %windir%/Downloaded Program Files/ZangoInstaller.dll
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ ModuleUsage\ %windir%/Downloaded Program Files/ZangoLib.dll
• HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ zango
• HKEY_LOCAL_MACHINE\ Software\ zango

Means of transmission 

Adware is a license form for using programs, which offers the application at the only cost of viewing a series of advertisements. However, these programs sometimes collect data on Internet usage habits, pages viewed, inventory of the applications installed in the computer, etc.

Zango can be manually installed or be included with other applications.

Further Details  

Zango is 282,624 bytes in size.