worm and I am not good at this computer stuff

[jhstyle]

I have windows xp i have avast,spyblaster,windowwasher,cleaner and the kids downloaded some kind of worm and avast prompted my to put in in the virus chest and i did but it still keeps sending a warnin you have a virus. please tell me how i get the avast to stop warning me or how to get rid of this virus i tried to delete the virus through avast but it wouldn't let me!

c:\programfiles\zangoclient\fleo\zanuhool.dll.tmp (this is what avast is telling me the worm is??

i didn't try to delete it i tried to repair it and it wouldn't let me.  also now avast is promting me to move it and i'm not sure if I should??

please all you computer wizards help me!

[DavidR]

Hi, welcome to the forums.

In order to help fully we need more information....
- What avast! version and VPS file (virus database) number, e.g. 0436-4 (see about avast!)
- What was the virus name, what was the filename, where was it found
  example (C:\windows\system32\infected-filename.xxx)?
- What actions have you taken to try and resolve the problem?

The filename 'zanuhool.dll.tmp' is suspicious as it has a double file extension .dll.tmp, this is commonly used to trick and confuse peopl into thinking it is a harmless temp file.

A google search for 'zangoclient' without the quotes returns some hits that indicate it is Adware - this is one of them - http://securityresponse.symantec.com/avcenter/venc/data/adware.zangosearch.html

If you haven't already got this software, download, install, update and run it.
1. Ad-Aware
2. Spybot Search and Destroy
3. Spywareblaster

Another useful tool is HiJackThis - Download HijackThis.zip - HiJackThis Tutorial
For an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.

[jhstyle]

Thank You David R!!!!!!!!!

I had the spyblaster and spy search and destroy.  but I added the adaware like you said and I think it got rid of the zango stuff that was making the avast warn me of the worm.

I think and hope its gone.  i didnt go to the hijacker info because i think it's gone.

I also saw something on the site that showed how to up the security but i don't know where it was ...it stated go to internet options/security/internet/custom level and i am not sure if i should disable all so that my daughters friends won't screw up the crt again.  They all come over here because their crt's have viruses and are useless, and i don't want them to screw this crt up.

thanks so much for your wizardry!!!

[DavidR]

Happy to have helped, although zango might be gone, HJT should be able to confirm and/or see other adware undetected by anti-adware progs.

The on-line analysis is painless, just cut and paste the contents of the HJT log file and click analyse.

[jhstyle]

hi david r

i went to http://hijackthis.de/index.php but i don't know what i am supposed to cut and paste it says go to the bottom of the page but i don't see anything??

can you tell be what i am supposed to cut and paste?
Thanks!!

[DavidR]

Have you visited the Tutorial site?

Run HJT, save the results. Copy the contents of the log file and paste it into the window and click analyse.