Zango said Thursday afternoon it was still investigating Fortinet's report. Facebook did not respond to requests for comment.

As detailed by Fortinet, Zango is being distributed via "Secret Crush," an application that tells Facebook members that one of their friends has a crush on them and then leads users through a series of screens to find out more information. At one point, users are told that they must provide the names of five friends to continue.

Finally, Facebook members are taken to a page where they can download a "crush calculator" that's bundled with Zango's ad-serving software, which trails people as they surf the Web and serves them pop-up ads. That last page discloses that Zango will serve users ads based on the pages they visit online.

Zango, one of the largest adware companies still in business, in 2006 settled FTC charges by agreeing to pay a $3 million fine and to follow procedures designed to prevent non-consensual installations of adware. Among other terms, Zango promised to provide clear and prominent notice about the adware program to users before they install it.

While Secret Crush gives users notice about the adware program, that information comes so late in the process that at least one Zango critic suggested it might not meet FTC requirements. "They've piled on so much extra context here that suggests to the user that this application is something else, that I would argue this is a misleading, deceptive, unfair installation," said Eric Howes, director of malware research for Sunbelt Software.

Spyware researchers have also accused Zango of trying to install software through MySpace pages. "It's clear that Zango has been targeting these social networking sites," Howes said.

This news story is important. I recommend that everyone read it.