SillyDog701

[profman]

Thread at netscape.public.mozilla.seamonkey

Dave Downing wrote:

> Hi All,
>
> I have been a great fan of Mozilla since 1.0 and a keen open source user. You can understand my concern though when the new Ad-Aware SE Personal reported the following:
>
> --------------------------------------------------------
> Vendor:iWon
> Category:Data Miner
> Object Type:Process
> Size:-
> Location:C:\...\Common Files\mozilla.org\GRE\1.7.2_2004080302\mozz.dll
> Last Activity:10-08-2004 11:27:16
> Risk Level:High
> TAC index:5
> Comment:
> Description:iWon Plus/Aornum; Installs a BHO. Connects to iWon servers. Ad client.
> --------------------------------------------------------
>
> I hope that Ad-Aware is wrong over this. My friend uses Firefox and does not get the same warning. Can someone re-assure me please? I hate IE.
>
> Dave

Hello Dave,

I wanted to put my two cents in to say that I had the same problem. I was trying out Ad-Aware SE Personal to see how it compared with my current spyware software. My current spyware didn't flag it (Pest Patrol), but I too was shocked to see that Mozilla would place an ad-client on my system. It is something I am not willing to believe.

My sons uses Firefox, and it didn't say a word. I checked and found that the Common Files directory "mozilla.org" doesn't exist with Firefox.

I, too, hope Ad-Aware is wrong. I recall seeing some comments about earlier versions of Firefox having adware/spyware, but I never found any.

Lavasoft must have made a mistake. I am e-mailing them now and will let everyone know what I find out from them.

Jeff

and a follow up

.............
Okay, I went to the Lavasoft forums and sure enough there was a lot of activity concerning this subject. Here is what Lavasoft has said thus far:

"This is currently being re-evaluated. Thank you for bringing this to our attention. In the meantime, please add this object to your ignore list."

I had already done this. Some people blindly deleted the file. If you have done this, you will have to reinstall Mozilla as it won't start after you remove the mozz.dll file.

Keep your eyes open for an update from Lavasoft to correct this problem and renew your confidence in Mozilla browsers.

Take care,

Jeff

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616

[profman]

Perhaps, according to a thread in netscape.mozilla.user.win32, Ad-Aware has already fixed this incorrect reporting.

Brian J. Graham wrote:

> My older version of Ad-Aware didn't recognize it, uninstalled that version and installed SE 1.01 and it didn't recognize it either ..mind you I had it update to the latest definition file and there is one for today (10th) that replaces one for the 9th! I would say they found a few glitches in that definition file and mozz.dll was one of them ...I am sure it is NOT associated with "IWON"!
>
> Brian


Hm... I just installed it today and was sure that I got the latest file. They must have updated it afterwards.

Anyway, that fixed it.

Sorry for the false alarm. I was just wondering if the release got compromised somehow.

Thanx,
--KUBI--

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616

[Wellander]

Hi,
Is Mozilla an adware?

UserAgent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; .NET CLR 2.0.40607)

[profman]

Hi,
Is Mozilla an adware?

No. It appears to be an error within the reference file for, at least, the personal edition of AdAware.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040616

[Gregor]

I use Ad-aware 6 build 6.181 for a while now. I also use Mozilla 1.7 but I have never had mozz.dll file on my list. Strange!
I am updating the reference file weekly. In Firefox this problem does not exist.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3

[Don_HH2K]

Hmm, now I'm gettings suspicious... Now we have ad-aware telling us that Mozilla is bad, before that we had someone that told us that Mozilla was malware (see "Tech Ignorance" and FUD while demo'ing Mozilla)...
Well, what's true? Did AOL force them to plant something in the source code shortly before they became a separate company, that would force people to use something else, like AOL?

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; m18) Gecko/20000929 Netscape6/6.0

[Fulvio]

"I had already done this. Some people blindly deleted the file. If you have done this, you will have to reinstall Mozilla as it won't start after you remove the mozz.dll file".

Adaware will do that, and even if you just quarantine, things will not be the same. I use it, and, as a matter of course, I reject anything which I don't quite understand. Then, I go to Spyware S & D. And, I, also have Spyware Blaster.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040803

[wolverine]

There is a backup on adware and you can usually restore someting you remove. I have noticed adware will also do this on other programs as well.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)

[Al]

This is very bad. I don't know if SB S&D would do this or not

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3

[Fulvio]

The backup should restore, but the eudora sponsored, which I had never worked as sponsored after Adaware hit it.
Anyway, I did a scan with Spyware S & D, and came out with the usual cookies.. Then, Adaware with the newest definitions, and it found some more cookies.
The thread in secnews indicated that Adaware mistook the file as part of IWon. But, this was an Adaware error. These things happen all the time.
I ran into a hilarious one when AOL came out with its anti-Spyware program.
It is designed to ignore cookies, so it is supposed to be pretty fast. The very first build took forever, and finally reported as a key logger the file allows one to sign on. It is probably true that it is spyware, but many people allowed it to be quarantine, with unpleasant reaults.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040803

[Alice]

This is very bad. I don't know if SB S&D would do this or not

If you mean, does Spybot S&D also detect mozz.dll as spyware, the answer is NO.

Spybot S&D can come up with other false positives, though, from time to time. For example, here's one I just saw on the Spybot forums
http://forums.net-integration.net/index ... opic=20421 Sb S&d V1.3 And Dell Support Services
Posted: Jul 27 2004, 05:55 AM

Spybot S&D v 1.3 detects the following registry key as Vx2/f.
Having Spybot fix causes automatic Dell Support Services to stop working.
Restoring the key restores Dell Support Services functionality.
Is this a bug in v1.3 or false positive or what? For now, until I get some guidance, this is flagged in my ignore list.

HKEY_LOCAL_MACHINE\Software\Vendor
VendorName Reg_SZ Dell

Posted: Jul 27 2004, 10:51 AM

False positive that should be fix with next detection update, according to buster2004 of Team Spybot S&D.

(Spybot's Recovery tool allows you to reverse any changes made by the program).

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.2) Gecko/20040803

[Al]

oh okay, that good since I use SB S&D

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7) Gecko/20040803 Firefox/0.9.3