Websense® Security LabsTM has discovered a number of user pages on the MySpace domain which have videos that look like they are from You Tube. The videos have an installer embedded within them for the Zango Cash Toolbar. When users click on the video, they are directed to a copy of the video, which is hosted on a site called "Yootube.info."

Warning: This site has adult images on it.

The site has a "click here for the full video" button and redirects users to a Microsoft® Windows® media video that requests users accept the end-user licensing agreement in order to watch the video. Assuming that users have accepted the agreement, the video downloads and attempts to install setup.exe from Zango Cash.

This is similar to another incident in the past where videos were posted on MySpace. However, the You Tube domain was not fraudulent and the video was posted on VitalSecurity.org.

The fraudulent You Tube website is hosted in Amsterdam and was up and running at the time of this alert. The registration for the domain name is also clearly fraudulent.

Do you want to see Zango content served up in dubious circumstances yet again? Well surprise, it's your lucky day because hot on the heels of this shambles we're about to go Trojan crazy. I guess someone needs to iron out the final few kinks in that all new and improved affiliate program, eh guys?

There's a file currently doing the rounds (by Email, so I'm told) that does some wonderful things to your computer. By wonderful, I do of course mean HORRENDOUS. Your IE Homepage is changed to a dubious search engine that pulls up both Yahoo and Google results (and tries to install some craptacular software), a bunch of dodgy sites are added to your Trusted Zone and you get a huge-assed Toolbar installed along with a load of popup action in the background.

Most interesting of all, when this thing first hits you see the page open up in the screenshot above - that's right, a massive page of Zango videos. In addition, an Icon is added to your Start menu that opens up the above website too. It doesn't take Sherlock Holmes to realise that whoever made the Trojan is directing people to their Zango affiliate videos - making a tidy profit into the bargain, of course.

...yes, I just made "Zangozones" up but it does fit with the latest Zango related finding (in that Zango is involved, and the infection file is related to the LowZones Trojan). LowZones lowers your Internet Explorer security settings, assuming you were wondering (and I know you were). Just in case you missed the last few writeups, here's a brief timeline first to set the scene

And now, a word from the most prolific Zango killer this side of the InterTubeNets, Papergshost.

In this episode, he alerts users of MySpace of an app that when you click the links, first a download begins and then you're taken to what is most likly a fake log in type of page. Then you get offered some super bit of software, which of course does nothing it claims.

Sounds like so many of the other MySpace\Zango scams.

Oh and don't foget to read the EULA. It's a gold mine of absurdity and laughable 'terms and agreements'.

A while ago on the Spywareguide Blog, I covered a technique being used in Peer to Peer land involving URLs being embedded in Quicktime movies, which would then pop open a website. This has now been taken to the next level, with an intensive and seemingly never ending Phish attack, the sole aim of which seems to be directing end-users to a collection of Zango movies on a pornographic website. The Phish pages are hosted on compromised servers - presumably the people doing the hacking aren't particuarly brilliant at it, because they keep getting found out (an example of them being caught in the act can be seen here).

How does this attack work?

It begins with a Quicktime file being embedded in a Profile page. If the user "runs" the file (simply visiting the infected page is enough to trigger the attack in most cases), it uses the HREF function to activate some javascript. HREF? Let's take a quick look at the Quicktime website:

Quote:

An HREF track is a special type of text track that adds interactivity to a QuickTime movie. HREF tracks contain URLs that can specify movies that replace the current movie, load another frame, or that load QuickTime Player. They can also specify JavaScript functions or Web pages that load a specific browser frame or window.

Allowing Javascript from a movie file....whoops.

...assuming you like lots of links to sites claiming to have illegal content, that is.

My good pal Mike Burgess found a site that contains a bunch of Zango clips.

But what is the content the site is supplying, apart from Zango Adware?

Aside from outgoing links to porn sites, absolutely nothing at all - apart from a Top 20 site list that contains some of the most dubious websites going.

Hey, you want a report of kiddy pr0n for one of the sites listed? Sure, here you go. Almost without exception, every single site on that damn list promotes the idea of young / illegal / completely messed up shit, many of which happen to have Russian and CWS connections. Just check out the screenshots below of some of the links on those pages - frankly, I'm glad I was testing with images switched off. Though some of the content might not be illegal, it sure as Hell is being promoted as such.

While tracking down sites linking to the latest Trojan.Codec previously mentioned today ... I find Zango running on another "Teen Porn" site. You can tell from the site title there is no doubt what this site is about.

It looks like Zango simply can't get enough of editing their own Wikipedia page, because here's what looks like Daniel Todd making more edits on the 1st of April (the text he removed is the stuff in red).

There's some more edits from IP addresses here and here, that - surprise - lead back to Bellevue, Washington in one case and the 180 Solutions Nameserver in the other. These edits involve removing links to the FTC ruling regarding Zango in the first instance, and Ben Edelman's work ("Nonconsensual Installations Continue Despite 180's S3 Screen") in the second. Whitewash, coming through!

Finally, a reference to this very site was similarly shot in the head by someone in - you guessed it - Bellevue, Washington (using the same IP address as the first edit relating to the FTC link). The edit in question? This one. Scroll down to "Line 62" to see what was removed.

On the 7th April, a Wikipedia Editor left the following comment on the Zango Wikipedia page after yet another removal of information relating to FTC Settlements:

"(reverting more unexplained removals, by anonymous user from Bellevue, Washington area - please take it to the talk page)"

Now, what's interesting here is that someone did just that - Daniel Todd, Head guy at Zango. He left a message on the Editor's talk page, of which you can see a sample below:

"Numerous parties have a vested interest in keeping information about Zango inaccurate."

..an interestingly vague statement. I think you'll find anyone involved in Security has a vested interest in keeping their infomation wholly accurate because, you know, they'd look stupid. So who do you mean? What nameless demons are we talking about? Are we actually referring to random boobs on the Internet? Yawn, I get them all the time whether they're leaving fake comments from myself on articles about Yapbrowser or super idiotic messages such as this one. It's called the Internet, deal with it.

Today I happened to check out the Zango Wiki page and found something vaguely spectacular.

Someone had made this change - for those who don't understand what's going on, the user effectively tried to change industry category Zango is placed in ("Adware") with "Computer Software".

Quite a significant change, yes?

The best is yet to come, however. They left the following quote on the changes page:

"I use Zango and ran into them at Adtech today...Calling them Spyware is inaccurate."

Note to Zango: IPs actually show where you are. When you make a change to the Wikipedia Zango propaganda page, EVERYONE knows you made the changes!!

Complaint for injunctive relief and tortious interference with business expectancy. The plaintiff's software, which "has been consensually installed by millions of users," is being destroyed by the defendant's "Spyware Doctor Starter Edition" application. The application does not give users specific warning that Zango's software will be deleted. The defendant's product has been distributed as part of a "Google Pack" of software tools, causing the plaintiff "irreparable harm." The plaintiff seeks at least $35 million in damages.

Regarding Zango’s lawsuit against PC Tools, this is not a trivial situation and needs to be followed closely in the security industry.

Here’s (apparently) the situation: PC Tools, with their free Google Pack edition (called the PC Tools Starter Edition), is (according to Zango), not providing “users specific warning that Zango's software will be deleted”.

We are a bit confused by this claim. Both Eric Howes and I loaded the PC Tools Started Edition last night and found no such evidence that Zango is deleted without specific warning.

I noticed the site had a rotating ad banner that randomly served up ads for free laptops, luxury cruises, smileys etc....you know the score. Well, I happened to see one or two ads appear in the rotating ad banner thing that happened to resemble YouTube style movie players. Generally, this means you can be sure that, whatever else, clicking the ad will NOT take you to YouTube. Eventually, curiosity got the better of me - would this be some hot new install? - and clicking one of the ads took me to....

Zango.com, with this particular page pushing Pamela Anderson movies. Apart from the creepy forum that took me there via the ad rotator, what I'm really curious about here is, after the series of events that took us to this (and then this), you'd think clickthrough-ads-looking-like-YouTube would now be looked at as something to be avoided like the plague.

Zango's request for a temporary restraining order against PC Tools has been denied.

In particular see pages 6-8, where the judge casts significant doubt on Zango's chances for prevailing in its claims of tortious interfence and trade libel.

Ok, the gang at Zango are claiming vixtory because Spyware Doctor no longer is targeting their files as 'not maliscious'. Wonder what the Spyware Doctor gang witll have to say to this?

This should be interesting indeed.

180Solutions

witll ... maliscious'

Can you link to the article?? I saw nothing on that site that even hints about Spyware Doctor. Did they say "victory"? Were you tired when you wrote this....

Last month, Zango filed a lawsuit against Australian software company PC Tools. That company’s “Spyware Doctor” product (at that time, version 5.0.0.169) literally and systematically eliminated Zango software from consumers’ machines without notice of any sort or any opportunity for them to object.