Not-a-virus:WebToolbar.Win32.Zango

Posted: August 17, 2011

Not-a-virus:WebToolbar.Win32.Zango, also well-known by the alias of ClickPotato, is an adware program that monitors your online habits and displays advertisements based on that information. Although Not-a-virus:WebToolbar.Win32.Zango's behavior is suspicious, our malware experts haven't found any instances of Not-a-virus:WebToolbar.Win32.Zango attacking your PC directly or trying to conceal itself, and as such, Not-a-virus:WebToolbar.Win32.Zango is classified as adware rather than malicious software. Not-a-virus:WebToolbar.Win32.Zango is often bundled with other programs and passes itself off as a streaming-video search engine, but you may wish to remove Not-a-virus:WebToolbar.Win32.Zango with an anti-malware application due to its usage of system resources, its monitoring of your online behavior and its advertisement-related annoyances.

How to Keep this Bad Potato Away from Your PC

Not-a-virus:WebToolbar.Win32.Zango is distributed with the ClickPotato program, which is also known by a range of aliases that encompass Adware.Zango.187, not-a-virus:AdWare.Win32.HotBar.dh, Adware-ClickPotato, Trojan.Generic.KDV.73075, ADSPY/AdSpy.Gen2, BScope.Injector.xg and Adware:Win32/ClickPotato. Not-a-virus:WebToolbar.Win32.Zango's advertisement-displaying habits lend Not-a-virus:WebToolbar.Win32.Zango to being classified as adware, while its monitoring of online actions causes some PC security brands to categorize Not-a-virus:WebToolbar.Win32.Zango as spyware. However, Not-a-virus:WebToolbar.Win32.Zango doesn't cause direct harm to your PC and isn't a high-level danger if you choose to refrain from deleting Not-a-virus:WebToolbar.Win32.Zango.

Our malware researchers have witnessed Not-a-virus:WebToolbar.Win32.Zango using the following distribution methods:

Not-a-virus:WebToolbar.Win32.Zango is often bundled with certain installation packages for freely-distributed software, particularly file-downloading programs. The list of Not-a-virus:WebToolbar.Win32.Zango-bundled programs includes 7zip, ARES 2010 Version, Audacity, Easy Video, eMule, FLVBlaster, Lime Wire, OpenOffice, ShopperReports, VLC and Xvid.
Dropper Trojans and browser hijackers have also been known to install Not-a-virus:WebToolbar.Win32.Zango without consent. In these cases, any attempts to delete Not-a-virus:WebToolbar.Win32.Zango should also accompany scans that can detect Trojans like Backdoor.Win32.Bredolab.obk, Trojan.Win32.Riern, Trojan.Dugenpal.A, Trojan.bosbot.A and Trojan.Healsock.
Not-a-virus:WebToolbar.Win32.Zango can also be downloaded, whether accidentally or deliberately, from its website, clickpotato.com.

Not-a-virus:WebToolbar.Win32.Zango can only be installed on certain types of web browsers, including Internet Explorer 6, 7 and 8 as well as Firefox 3.6 and Firefox 4.0.

Why Non-Virus Zango Still Isn't a Great Thing to Have on Your PC

Not-a-virus:WebToolbar.Win32.Zango can be seen, like any other browser add-on, in the appropriate menus and by noting the shortcuts that Not-a-virus:WebToolbar.Win32.Zango adds to your browser windows. Other symptoms of Not-a-virus:WebToolbar.Win32.Zango's presence, along with the attendant problems that our malware analysts have found are noted below:

Not-a-virus:WebToolbar.Win32.Zango will monitor your online habits, including search queries and website visits, to gather information about your media preferences and tailor its advertisements to this data. This passive usage of system resources may worsen system performance as well as violating your privacy.
Not-a-virus:WebToolbar.Win32.Zango may update itself without your consent, allowing Not-a-virus:WebToolbar.Win32.Zango to add extra features on a whim.
Not-a-virus:WebToolbar.Win32.Zango may alter the results that Not-a-virus:WebToolbar.Win32.Zango shows you, to direct you towards links that are profitable for Not-a-virus:WebToolbar.Win32.Zango's maintainers.
Most visibly, Not-a-virus:WebToolbar.Win32.Zango will show a variety of advertisements via pop-up windows and other methods, regardless of what you may be doing at the time.

Not-a-virus:WebToolbar.Win32.Zango may be accompanied by other adware components, such as BrowserModifier:Win32/Zwangi, Adware:Win32/HotBar or Adware:Win32/ShopperReport. Any efforts at removing Not-a-virus:WebToolbar.Win32.Zango should use appropriate security software that can also detect these related adware programs.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\f87e26db85ab04461d0f241563b72a42_a7bcc1a4-f7a4-4502-8650-8579e607f7f7

File name: %AppData%\Microsoft\Crypto\RSA\S-1-5-21-606747145-764733703-839522115-1003\f87e26db85ab04461d0f241563b72a42_a7bcc1a4-f7a4-4502-8650-8579e607f7f7

%Temp%\upg7.tmp

File name: %Temp%\upg7.tmp
File type: Temporary File
Mime Type: unknown/tmp

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5