453522 - New Thunderbird installation triggered Spyware Doctor v.6 to report adware to be installing

Status: RESOLVED INCOMPLETE

(Thunderbird :: Installer, defect)

Description

[Jack Oden]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1
Build Identifier: version 2.0.0.16 (20080708)

Every time I tried to do fresh install of Thunderbird on new Win-XP install, Spyware Doctor v.6 reports "Adware.Zango_Search_Assistant" malware is attempting to install.  I deleted the file and re-downloaded from http://en-us.www.mozilla.com/en-US/products/thunderbird/, but the malware tries to install each time.

Reproducible: Always

Steps to Reproduce:
1. Attempt to install Thunderbird.
2. SD v. 6 identifies malware (Adware.Zango_Search_Assistant) detected.
3. -Must have Spyware Doctor v.6 active in the background. 
Actual Results:  
As soon as I click on "Thunderbird Setup 2.0.0.16.exe," Spyware Doctor reports the following: POTENTIALLY UNWANTED PRODUCT DETECTED. <next line> Spyware Doctor has Detected but not blocked the potentially unwanted product "Adware.Zango_Search_Assistant" <next line> To block next time, click Block...

Expected Results:  
After several attempts, I choose "Permanently Block" and have not had any problems since. 

I hope this is not a trend.

Comment 1

[Steve Simms]

Have you installed any Zango software, perchance?

http://www.removeadware.com.au/articles/zango-search-assistant/

Does the Spyware Doctor program specifically mention Thunderbird anywhere in the warning message?  Do you get the same warning if you try and install a new version of Firefox (or another program)?

Comment 2

[Jack Oden]

No, I have not installed any Zango software. I also ran the recommended XoftSpySE and it failed to find any Zango software.

I don't know how, but it seems the zango malware somehow came with the Thunderbird download.  It's a mystery to me.  

Since I have set Spyware Doctor to permanently block this program, I cannot tell if it is trying to install with any other programs.

Comment 3

[Jack Oden]

When updating to the new version of T-bird (2.0.0.17), it happened again... Spyware Doctor v.6 reported "Adware.Zango_Search_Assistant" malware is
attempting to install. I elected to permanently block the software with Spyware Doctor. 

Where is this malware coming from? T-bird is the only program it seems to attempt installing with, so I thought it must have downloaded with T-bird. Could a third-party have somehow slipped it into my original download of T-bird? Had I not been running Spyware Doctor, I would be infected with this malware and that angers me.

Comment 4

[Steve Simms]

Can you try installing the same downloaded file on a different computer, and see if the same thing happens?  I'm guessing there would be a lot more reports of this problem if it were a problem with the installation package.

Comment 5

[Magnus Melin [:mkmelin]]

Any shady extensions installed?

Comment 6

[Jack Oden]

The only add-on extension is Cooliris, and I hope it's not that since it's such a great add-on. Again, I hope this was just a fluke and never happens again.

Comment 7

[Wayne Mery (:wsmwk)]

or could be false positive.

Jack, any success with comment 4?

Comment 8

[Wayne Mery (:wsmwk)]

does problem go away when started in safe mode?

Comment 9

[Joshua Cranmer [:jcranmer]]

RESO INCO due to lack of response to last question. If you feel this change was made in error, please respond to the bug with your reasons why.