Your original links have been removed - Supracentral
DO NOT POST ANOTHER ZANGO LINK!
This executable program has a file size of 333,064 bytes, it is most frequently called SETUP[1].EXE and is most frequently located in the %temp%\ folder.
The file header contains the following information:
Vendor : Zango, Inc.
Product: Zango Installer
Version: 52, 0, 2,
This file is considered unsafe and is part of the malware group, Adware.Zango. It was first seen on Friday, Mar 7 2008. It has been seen frequently by 16 users in this section of the community. The file was first seen in FRANCE but has been seen in other locations, including The UNITED KINGDOM.
SETUP[1].EXE has been seen to perform the following behaviors:
- The Process is packed and/or encrypted using a software packing process
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Enables an In Process Object/Server - Common with DLL Injections
- This Process Deletes Other Processes From Disk
- Can communicate with other computer systems using HTTP protocols
- Executes Processes stored in Temporary Folders
- Executes a Process
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Creates Other Processes On Disk
SETUP[1].EXE has been the subject of the following behaviors:
- Created as a process on disk
- Deleted as a process from disk
- Executed by Internet Explorer
- Has code inserted into its Virtual Memory space by other programs
- Executed as a Process
DO NOT POST ANOTHER ZANGO LINK!
This executable program has a file size of 333,064 bytes, it is most frequently called SETUP[1].EXE and is most frequently located in the %temp%\ folder.
The file header contains the following information:
Vendor : Zango, Inc.
Product: Zango Installer
Version: 52, 0, 2,
This file is considered unsafe and is part of the malware group, Adware.Zango. It was first seen on Friday, Mar 7 2008. It has been seen frequently by 16 users in this section of the community. The file was first seen in FRANCE but has been seen in other locations, including The UNITED KINGDOM.
SETUP[1].EXE has been seen to perform the following behaviors:
- The Process is packed and/or encrypted using a software packing process
- Adds a Registry Key (RUN) to auto start Programs on system start up
- Enables an In Process Object/Server - Common with DLL Injections
- This Process Deletes Other Processes From Disk
- Can communicate with other computer systems using HTTP protocols
- Executes Processes stored in Temporary Folders
- Executes a Process
- Writes to another Process's Virtual Memory (Process Hijacking)
- This Process Creates Other Processes On Disk
SETUP[1].EXE has been the subject of the following behaviors:
- Created as a process on disk
- Deleted as a process from disk
- Executed by Internet Explorer
- Has code inserted into its Virtual Memory space by other programs
- Executed as a Process
Last edited by a moderator:
