Ghostery shows "chango" trackers on sites that shouldn't have trackers at all

Question

If I visit pages which should not have trackers like www.google.com, my Ghostery addon signals that "chango" is blocked. I asked a colleague to install Ghostery and check if he sees the tracker too, but it only appears on my laptop.

I tried a malware scan but could not find anything.

Does anyone know how to get rid of this tracker which must be installed on my laptop somehow? I block everything with Ghostery and on www.superuser.com for example, three items are blocked for me:

• Chango
• Google Analytics
• Quantcast

This is my list of my ff-addons - hope it helps:

Application: Firefox 11.0 (20120312181643) OS-System: WINNT (x86-msvc)

• Ad-Aware Security Toolbar 0.9
• Adblock Plus 2.0.3
• Auto Copy 1.0.1
• BetterPrivacy 1.68
• ChromeBug 1.7X.0a3
• Collusion 0.16.2
• DOM Inspector 2.0.10
• DoNotTrackPlus 2.0.9
• DownloadHelper 4.9.8
• DownThemAll! 2.0.13
• Extension List Dumper 1.15.2
• Facebook Blocker 1.4
• FlashGot 1.4.1
• FoxyProxy Standard 3.6
• Ghostery 2.7.2
• Greasemonkey 0.9.18
• Illuminations for Developers 1.1.11
• iMacros for Firefox 7.4.0.8
• InvisibleHand 3.6.8
• Liquid Information 9.6
• Live HTTP headers 0.17
• LocalLink 0.5
• Nuke Anything Enhanced 1.0.2
• privacyscore by PrivacyChoice 1.0
• QuickNote 0.6.0.10
• Selenium Expert (Selenium IDE) 0.12
• Selenium IDE 1.7.2
• Selenium IDE: C# Formatters 1.7.2
• Selenium IDE: Java Formatters 1.7.2
• Selenium IDE: Python Formatters 1.7.2
• Selenium IDE: Ruby Formatters 1.7.2
• Send Tab URLs 2.1
• Show MyIP 0.8
• SimilarPages 1.3.2
• SimilarWeb 1.4.27
• Sitzungs-Manager 0.7.8.1
• SQLite Manager 0.7.7
• StumbleUpon 3.99
• User Agent Switcher 0.7.3
• WindowShopper 1.2.0.13

I also should mention that I had to get rid of the malware "security shield". It was really annoying this malware. Here is a link to remove it remove security shield. There could be a possibility that the tracker is a leftover of this malware or the antimalware I installed to get rid of it: Spyware Doctor,Malwarebytes Anti-Malware and Ad-Aware.

best, US

Answer 1

Now that I see your list, WindowShopper is the culprit. I wish I could say that this is the first time I see Superfish junk, but its not, they are a known affiliate marketing and advertising company that disguises their stuff in "harmless" addons. Since their addon is hosted on AMO, it must have some opt-in method -- they are not allowed to turn it on without letting the user know that this is happening, but I do not actually see a method like this, so I'll submit a delisting request in a few minutes to take it down until they fix this.

The rest of the addons you have look legit, so try disabling WindowShopper and see if the issue goes away.

Answer 2

Chango showing up everywhere is a sign that your traffic has some stuff injected into it by a 3rd party. Usually, this is done by another addon or toolbar you might have installed as this is the easiest place to inject such stuff, so, what other addons do you have running along?