Wednesday, March 24, 2010

How to remove the "Bing.Zugo" toolbar hijack

Today I discovered that the Bing.Zugotoolbar had hijacked by Internet Explorer browser. Naturally, I want it unintalled, since its really bothering me. It forces me to use their search page, and seems to re-route my browser to other pages when I type in a URL. God knows what kinds of stats they are collecting on me, or if they're monitoring my key strokes.

I first went to my Windows control panel > add/remove programs, but there was no unintall program listed for either Bing or Zugo.


Next I went to Internet Explorer > Tools > Manage Add-ons. Scroll way down to the bottom of the list (probably why they chose a name that begins with a Z) and you will see the Zugo toolbar listed. Click on these items and disable them.

Now, right click on the Windows Start button in the lower left corner of your screen, and choose "Open Windows Explorer." Navigate to:

C:\Program Files\SearchToolbar

In this folder you will find the hidden Zugo uninstall programs. I ran these and they did indeed seem to remove Zugo from my computer, at least the file sin the directory. They did leave behind registry entries that continue to affect browser settings. 
You will have to remove the Zugo keys from your registry with RegEdit, Windows Registry Editor. Be very careful here, since messing up your registry can be bad thing.

In Windows, click Start and type: Regedit

After RegEdit loads, navigate to HKEY_CURRENT_USER\Software\Zugo

Right click on the ZUGO folder and DELETE


If you have Firefox installed, then you have an extra step to perform.

1. Open FireFox and instead of a url, type: about:config 
2. Firefox will give you a scary warning, but go in anyway. We must be brave.
3. Locate the keyword.url line. It should look like this:
4. Use your mouse to right click on keyword.url, then select Reset

That should do it!
 
While this is certainly a browser hijack, I can't tell if it is malware of any sort, or a virus. Dr. Web reports the threat level of Zugo as "ignore" but that doesn't seem wise to me. I've reported this as Malware to Google and to everyone else I can think of, but the issue doesn't seem to get much attention.

Neither Panda Anti-virus software or Microsoft Security Essentials caught this as of this writing. Caution is order.  Clearly, this is a company that make money when their crap is installed on your computer influencing what you see and where you go. That is always a bad thing.

Beware of Zugo.

If this has helped you, please pay it forward. I suggest making a donation to the Electronic Frontier Foundation (www.eff.org). They are a non-profit organization that has lawyers and smart people fighting to preserve your internet privacy and freedoms. They are WELL worth your support.  Please at least sign up for their free newsletter so you can learn about important internet privacy issues facing all of us.

21 comments:

Airelon said...

There's a new version of this hi-jacker out there. It seems to place a plugin somewhere on the system, which makes sure the hijacker remains on the system.

If you successfully remove the hijacker via the steps above? The backdoor just places it right back there again.

I'm about ready to go buy a mac ...

Dan

Kathy said...

Thank you so much!
I downloaded Bing to join a free movie site at the site recomendations
..*never again*.

After it downloaded... my email address page disapeared and was replaced with this weird Microsoft imitation page with huge font. I tried to find Bing to uninstall but it was not there. I located Zugo ONLY by the date...it was installed...that's how it was found.
I followed your instructions and then uninstalled AGAIN from the control panel's programs..rebooted and my computer is back to normal

I am still uneasy..I might switch to a Mac,too

Anonymous said...

I just caught Zugo on my system for the second time. It was version 1.1. The instructions here seemed to remove Zugo.
However, I had to open IE>Tools>Options>Homepage and remove the Zugo code from the home page url.

Anonymous said...

Thank You! I hate these things.

I contracted the ZUGO toolbar junk after installing the cool 'free' ZipGenius app (http://www.zipgenius.com/).

The app is as nifty as advertised, but the ZUGO hidden cost sucks.

Miles Cole said...

Thank you

Anonymous said...

All you guys work for Google? haha Google does the same distribution methods as Zugo. They are not adware. all of you were given an opportunity to opt-out of this toolbar.

Smart Moms Saving Money said...

Thank you for your help, I followed your directions and it looks like it worked I sure hope it's gone. I'll keep my fingers crossed, it stays gone for good. I can't really remember where I picked it up, but I noticed when I turned on my computer the other day that my homepage was changed to Bing. I sure don't remember saying I'd change it since I use SwagBucks to earn rewards and money. I'd rather be paid for my searches and time.
Thanks again! :)
Laura

Anonymous said...

Thanks, this worked. It had bugged me for months!

I got infected by Bing Zugo from BitDaddy's "free" email viewer software, Email Open Viewer Pro.

It proves again that nothing is really free.

If these companies were more upfront about it it wouldn't be so bad. But they install this shit very quietly and don't even give you a way to uninstall it. That should be criminal. Nobody ASKED me if I wanted my browswer hijacked with no way to uninstall it. Maybe it was hidden deep in a user agreement, but still, it should be illegal. First class action lawsuit, post it here and I will join up.

Claire said...

I am amused by how many people are surprised, dismayed and complaining about this software. During the install process for whatever "free" software you are asked if you want the Bing toolbar. The default is yes. Are you clicking "Next" without reading anything? Do you read the TOS, etc? Probably not, if you can't be bothered to read one step of an install dialog.

Anonymous said...

"Claire" show me in the TOS where it says "you will never be able to uninstall this crappy software."

The big problem is the way this junk is surrepitiously represented. It is dishonest. Why should people have such trouble removing this shit?

Anonymous said...

I agree that Zugo is being dishonest. I swear I was never given any chance to opt out, or else it was represented as something else. WHY CANT I UNINSTALL ZUGO??

BING!!! ARE YOU LISTENING!!!?? WHY DO YOU LET THEM DO THIS CRAP IN YOUR NAME!!?? IT TARNISHES THE BING AND MICROSOFT NAMES.

Class action lawsuit, anyone?

Anonymous said...

the assholes that are sticking up for this crap toolbar probably have a role to play in them..even if people opted into this crap bar most definitely on accident without knowing better..zugo hides itself so it cant be easily removed that in itself is very deceptive and not good business practice..make a useful product thaqt people will want not one that u have to hide from people to remove.

Ares26 said...

Their is another Bing.com in about:config for firefox... Scroll all the way down to find:
1. {5911488E-9D1E-40ec-8CBB-06B231CC153F}.keyword_search_url;http://www.bing.com/search?pc=Z152&form=ZGAADF&install_date=20110817&q=
2. {5911488E-9D1E-40ec-8CBB-06B231CC153F}.update_url <-- RESET this... update_url is the photo for BING. Hope this helps!

Ares26 said...

Last part of removing BING bar from zugo/startnow. Goto firefox pluggin section and remove startnow(Pluggin).
DONE!!!! Have fun!

Justin said...

When I disable and removed the StartNow Extension in firefox, it completely fixed my problem. It just sucks when these things change your system and give you no clue where it came from!

Anonymous said...

Justin, it worked! Thank you so much.

Anonymous said...

My my windows 7 I had to remove the 'StartNowToolbar' in the control panel. After that, Bing was removed. How frustrating.....

somoto said...

thanks, it's helped

Anonymous said...

thanks bro, eset couldnt get rid of it , and kept warning me!

EYElene said...

I can't get rid of Bing!
I went to all the places like the extensions in FF and the Control Panel but those files mentioned are not there. I hate this. Help!

Anonymous said...

Here's a link to another discussion about Bing Zugo. They've changed their name (or added a new one). If you're interested in Zugo, check it out.

http://bad-bytes.blogspot.com/2011/08/little-analysis-on-that-zugo-toolbar.html