My recent fight with spyware — Zangdo.com and iTotalFind

HijackThis logo.Some deals are too good to be true, and yet we still fall for them. Take, for instance, Zangdo.com. To make money and get your instant USD25 from them, all you have to do is to install their supposedly spyware- and adware-free Zangdo Buddy software. They even put in a link to SafeVendor to make their claim that Zangdo Buddy is spyware-free. Nice, I thought, so I went on ahead and installed it.

So imagine my frustration when, as soon as my installation was done, I opened up my default Firefox browser and find that all the AdSense ads I see in any web site I see were transformed to adverts by iTotalFind.com. At first I thought that all the blogs were hijacked, but I soon found out that I only see this happening through my Firefox browser and not my IE (Zangdo.com automatically opens up my default browser as soon as I was done installing). Not only that, even though I installed a popup blocker, every time I use Firefox and double-click on a web site or click on a link, a pop-up still appears and opens up iGoogle of all places.

Luckily, Castle Corps has a wiki on how to remove spywares and malwares, and so I followed the step-by-step instructions on how to remove them. I installed HijackThis, Spybot Search & Destroy, CCleaner and AVG Anti-Spyware (all very good and very free) to remove the iTotalFind problem as well as any other hidden malwares. I even re-installed Firefox just to be sure.

When I opened back Firefox, the problem was still there. I almost surrendered and was close to submitting my HijackThis log, when I saw two peculiar entries in the log, both with an IP address starting with 64, and has Google AdSense URL string attached to both of the log entries. I selected these two and got HijackThis to fix them. I reopened my Firefox and surfed some AdSense-filled blogs, and gave out a sigh of relief that my predicament was over.

Related post:  Keyword Academy, where are you and what's going on?

All this happened yesterday in the span of 3 hours. HijackThis is the bomb!

Spread the love

Check out my other posts: « / »

Posted on 6 March, 2008 under Life online and tagged with , , , ,

7 comments

  1. This has to be the worst thing about the internet. I recently saw a post about how you can use a fake virus to see if your virus software is working correctly. You’ve just reminded me to go find that article again.

  2. Hi Webgrrl

    thanks for checking out my blog. i appreciate your suggestion of including full posts in the feed, however despite my efforts I’m unable to figure it out. I’ll keep on try periodically, but i’ve asked other bloggers and its not working, so don’t keep your hopes up!

    I had a similar issue with zango. a favorite site of mine that had the wordss “watch futurama online” strung together in the URL suddenly insisted that I install zango inorder to access the site. I completely refused to be coerced into installing crap and decided my days of watching futurama are over!

    but on the flip side, if you see adsense or other ads, does it really make a difference?

    1. Lorna says:

      Hmm… I would have thought that providing full feed would be as easy as going to your admin panel’s Options > Reading > Syndication Feeds and selecting Full text, did you try that?

      Looking at iTotalFind’s ads is totally annoying because not only does it display some nonsense text, it also causes your browser to hang! You definitely made a smart choice out of not installing Zango!

  3. You the man! er…wo-man.

    thanks for the that. somehow i never figured out where the damn thing was.

  4. drwiz says:

    Spywares comes in all shapes and sizes, I always google before installing any suspicious softwares. Spyware Blaster is a pretty cool tool to tackle spywares, try it.

  5. Gotta love spyware! Especially one that pays you to install it. Thanks for the heads up!

  6. I am using hijackthis, too. It is very useful. Yesterday my pc was infected by ntos. But now I have totaly deleted it. I hate spywares…

Comments are closed.