I have windows xp i have avast,spyblaster,windowwasher,cleaner and the kids downloaded some kind of worm and avast prompted my to put in in the virus chest and i did but it still keeps sending a warnin you have a virus. please tell me how i get the avast to stop warning me or how to get rid of this virus i tried to delete the virus through avast but it wouldn’t let me!
c:\programfiles\zangoclient\fleo\zanuhool.dll.tmp (this is what avast is telling me the worm is??
i didn’t try to delete it i tried to repair it and it wouldn’t let me. also now avast is promting me to move it and i’m not sure if I should??
please all you computer wizards help me!
Hi, welcome to the forums.
In order to help fully we need more information…
- What avast! version and VPS file (virus database) number, e.g. 0436-4 (see about avast!)
- What was the virus name, what was the filename, where was it found
example (C:\windows\system32\infected-filename.xxx)?
- What actions have you taken to try and resolve the problem?
The filename ‘zanuhool.dll.tmp’ is suspicious as it has a double file extension .dll.tmp, this is commonly used to trick and confuse peopl into thinking it is a harmless temp file.
A google search for ‘zangoclient’ without the quotes returns some hits that indicate it is Adware - this is one of them - http://securityresponse.symantec.com/avcenter/venc/data/adware.zangosearch.html
If you haven’t already got this software, download, install, update and run it.
- Ad-Aware
- Spybot Search and Destroy
- Spywareblaster
Another useful tool is HiJackThis - Download HijackThis.zip - HiJackThis Tutorial
For an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
Thank You David R!!!
I had the spyblaster and spy search and destroy. but I added the adaware like you said and I think it got rid of the zango stuff that was making the avast warn me of the worm.
I think and hope its gone. i didnt go to the hijacker info because i think it’s gone.
I also saw something on the site that showed how to up the security but i don’t know where it was …it stated go to internet options/security/internet/custom level and i am not sure if i should disable all so that my daughters friends won’t screw up the crt again. They all come over here because their crt’s have viruses and are useless, and i don’t want them to screw this crt up.
thanks so much for your wizardry!!! 
Happy to have helped, although zango might be gone, HJT should be able to confirm and/or see other adware undetected by anti-adware progs.
The on-line analysis is painless, just cut and paste the contents of the HJT log file and click analyse.
hi david r
i went to http://hijackthis.de/index.php but i don’t know what i am supposed to cut and paste it says go to the bottom of the page but i don’t see anything??
can you tell be what i am supposed to cut and paste?
Thanks!!
Have you visited the Tutorial site?
Run HJT, save the results. Copy the contents of the log file and paste it into the window and click analyse.