Latest Ad-Aware Signaturefile: 241-14.01.2002

Printable View

Show 40 post(s) from this thread on one page

January 14th, 2002, 06:19 PM
Mowergun

Hey discogail...good, how r u?

Funny thing is I've never had any file sharing programs like Kazaa on my machine. However, I know this Dell is a reconditioned unit. Could there be stuff left in the registry from the previous owner? Beats me!

Mowergun

------------------
God save thee Windows users, from the fiends that plague thee thus.
January 14th, 2002, 10:24 PM
IMM

I haven't really looked at source for all the keys but the UUID
{618736e0-3c3d-11cf-810c-00aa00389b71}
is placed in HKR (several locations) by office 97 installs. One example is:
HKEY_CLASSES_ROOT\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}

The original install of office97 doesn't place this uuid in
HKEY_LOCAL_MACHINE\software\classes\interface\
or any other HKLM key as far as I know on the install but interactions with other stuff?

Be interesting to follow this.

[This message has been edited by IMM (edited 01-14-2002).]
January 14th, 2002, 11:18 PM
discogail

There's a little bit of talk around re: MS accessibility Aids.
One post on Grc.......
"Did a search thru registry for ONLY ONE of the keys found
by Ad-Aware.

This one: EzuLa
key:HKEY_LOCAL_MACHINE\software\classes\typelib\{1ea4dbf0-3c3b-11cf-810c-00a
a00389b71}\

OK, now here is a SMALL part of that one particular key:
[HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00
389B71}\1.1\0\win32]
@="oleacc.dll"

OK, next I did a Find for oleacc.dll and this is the result of that:
Something about "Active Accessability Core Component"....

A followup offered:
"Active Accessibility is
used by adaptive equipment to access information on the computer. For instance
I work with people who are blind and visually impaired and they often use
programs like JAWS, Simply Talker or ZoomText to read the text on the screen."

And:
Microsoft® Active Accessibility® is a developer technology that improves the way programs and the operating system work with accessibility aids. Active Accessibility can help software developers make their programs more compatible with accessibility aids, and accessibility aid developers can make more reliable and robust aids.

As an underlying technology, Active Accessibility is invisible to users. Active Accessibility, used by developers since 1997, may already be in the operating system and programs you use today. For example, Active Accessibility is in Microsoft Office 97 and Office 2000, Microsoft Windows® 98 and Windows 2000, and Microsoft Internet Explorer 3.0, 4.01 and 5.

http://msdn.microsoft.com/library/de.../html/msaa.asp
January 15th, 2002, 01:57 AM
^dAvEy^

Quote:

Originally posted by Kleinkramer:
Alexa is a little different, in that it comes with Internet Explorer, where'it's responsible for the 'related sites' feature.
Also see...

thanks for the info, Kleinkramer...
lotsa todo going on about it like ALEXA though, eh?

------------------
^dAvEy^

[This message has been edited by ^dAvEy^ (edited 01-15-2002).]
January 15th, 2002, 02:27 AM
Nanceel0

Hi Renovator!
Thanks for letting us know about the latest refupdate!
And, it's good to see you back! https://discussions.virtualdr.com/
Sincerely, Nancee

P.S. I am now running InnoculateIT https://discussions.virtualdr.com/
and like it! Thanks.
January 15th, 2002, 03:15 AM
Nanceel0

Well, I just ran AdAware and it found Alexa (which I let it remove) and the 3 Ezula registry keys too. I know at Windows Updates it listed "accessibility tools" as already installed so I'm thinking that's it.
I'm going to wait on this one and read the link Discogail posted.
Sincerely, Nancee
January 15th, 2002, 03:31 AM
discogail

There are also some posts about removing the keys.........& then finding that they are back.........after using the Windows "search" function????!!!.
it's getting wierder.
The security.software NG at news.grc.com has some long threads going.
January 15th, 2002, 06:47 AM
Shey

My log from Spyblocker seems to tie Ezula to akaimai.net, another nasty. This is the log prior to my running Adaware refupdate on the 13th and after:

Logged Entry Sunday, Jan 13 2002 at 09:52:10 PM
Remote Port: 1325
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]
[BLOCKED BUG]

GET /7/94/1622/2/www.ezula.com/eZula.css HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:10 PM
Remote Port: 1325
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/NewHomePageImages/logo_eZula.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:11 PM
Remote Port: 1326
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/small_nav_tag.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:11 PM
Remote Port: 1327
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/NewHomePageImages/HomePage_TopBar_LongTagline.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:11 PM
Remote Port: 1329
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/NewHomePageImages/Splash_W_Download_Image.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:52 PM
Remote Port: 1336
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_UL.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:52 PM
Remote Port: 1337
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_T.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:52 PM
Remote Port: 1338
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/common/yellow_bullet.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:53 PM
Remote Port: 1339
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_B.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:53 PM
Remote Port: 1341
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_UR.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:53 PM
Remote Port: 1345
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/1/www.ezula.com/images/ezula-map.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:54 PM
Remote Port: 1347
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_L.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 09:52:54 PM
Remote Port: 1347
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]

GET /7/94/1622/2/www.ezula.com/images/template/link_R.gif HTTP/1.1
Accept: */*
Referer: http://www.ezula.com/company/contact.asp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a94.g.akamai.net
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 10:03:03 PM
Remote Port: 1410
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]
[BLOCKED BUG]

GET /cnet.1d/css/ie.css HTTP/1.1
Accept: */*
Referer: http://download.cnet.com/downloads/0...0-6372708.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a.r.tv.com
Connection: Keep-Alive

Logged Entry Sunday, Jan 13 2002 at 10:03:03 PM
Remote Port: 1410
Remote Host: 127.0.0.1
[BLOCKED ADVERTISEMENT]
[BLOCKED BUG]

GET /cnet.1d/css/all.css HTTP/1.1
Accept: */*
Referer: http://download.cnet.com/downloads/0...0-6372708.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)
Host: a.r.tv.com
Connection: Keep-Alive

Perhaps just tied to advertising.

Shey https://discussions.virtualdr.com/

Specs:
Powerful PC, InnoculateIt, ZoneAlarm, Spyblocker
PopUp Stopper
Cookie Wall
Web Washer
January 15th, 2002, 08:11 AM
buck52

Howdy

"There are also some posts about removing the keys.........& then finding that they are back.........after using the Windows "search" function????!!!."

I can confirm this...I had removed the Ezula keys with AdAware..after reading this I did a search for nothing special( on my computer, not the internet) and then ran AdAware again and the three keys were there again !!

XP Home
edit... For the heck of it I just removed the keys on my 98SE machine then did a search = find files then ran AdAware again and the keys were not replaced

------------------
just hav'n fun

[This message has been edited by buck52 (edited 01-15-2002).]
January 15th, 2002, 08:26 AM
Mowergun

Hey! Guess what!

I ran adaware again and came up with nothing. Then I opened the accessability wizard and then exited without saving any changes. Then I clicked on the Magnifier, (which magnified everything that I pointed my curser at, while at the same time rearranging all my icons, so I had to move them back). Then I ran adaware again and all of the ezula registry keys were back. Yep, looks like that clinches it for me, a false positive. Adaware its identifying keys related to accessibility aids as ezula. On the other hand, if these accessability aids are from a third party vendor that is an ezula client??? Well... I'm only half deaf, half blind, and half gullible, so I think I might uninstall the accessibility aids just to be on the safe side.

Mowergun

------------------
God save thee Windows users, from the fiends that plague thee thus.
January 15th, 2002, 11:08 PM
discogail

Picked up this post at DsL reports...security discussion group.....

"Got a few referrals from this thread to our online eZula detector at » www.WhirlyWiryWeb.com/q/ezula.asp

I'd like to post a little warning about the latest edition of Ad-aware, as perfectly clean systems may now prove 'infected'.

I noticed a few cases where Ad-aware unexpectedly reported infection.
I'm talking about registry keys featuring
03022430-abc4-11d0-bde2-00aa001a1953
618736e0-3c3d-11cf-810c-00aa00389b71
1ea4dbf0-3c3b-11cf-810c-00aa00389b71
c95fe080-8f5d-11d2-a20b-00aa003c157a

These refer to Microsoft components and have nothing to do with eZula. The components may be _used_ by eZula though.
Just as plain good applications may.

I don't recommend deleting these registry entries, by no means security holes. You may break existing or future apps that count on their presence."

RockinFewl, WhirlyWiryWeb.com
January 15th, 2002, 11:35 PM
Nanceel0

Hi Discogail,
Thanks for posting that (especially since I can't get to what you've been finding https://discussions.virtualdr.com/). I just compared my AdAware log to the 4 keys you copied and I had all of them - that last one is the Alexa thingy, which I did remove.
I'll keep those 3 keys unless I hear it's best not to. I appreciate your help with this.
Sincerely, Nancee
January 15th, 2002, 11:53 PM
discogail

Hi....Nancee........the Lavasoft forum is accessible again...but there's nothing going on re: this....yet.
If you want to read the thread over at DSL Reports.....62 replies last time I checked......it's at.
http://www.dslreports.com/forum/rema...ty,1~mode=flat
January 16th, 2002, 01:26 AM
Nanceel0

I appreciate the link Discogail. https://discussions.virtualdr.com/ I read all the posts and was amazed at some of those thief sites! I think it's safe to leave those keys on my computer for now.
Sincerely, Nancee
January 16th, 2002, 10:31 AM
lukeg

This Key and its Values are Normal for Windows98se, its connection with
"Alexa" is via redirecting, it is not DIRECTLY spying on you.
If you examine the below registry value (exported from registry and pasted here) you see the "Script" is, well not easy to find,("Script"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,77,65,62,5c,72,65,6c,61,74,65,\
64,2e,68,74,6d,00),
However if you navigate using regedit to this Key it will appear as this;
---------------------------------------------
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}]
"MenuText"="@shdoclc.dll,-864@1033,Show &Related Links"
"MenuStatusBar"="@shdoclc.dll,-865@1033,Shows links related to the current page."
"Script"="C:\WINDOWS\web\related.htm"
"clsid"="{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}"
"Icon"=",4"
"HotIcon"=",4"
"ButtonText"="@shdoclc.dll,-866@1033,Related"
---------------------------------------------
What is important here is the "Script" and it is located here C:\WINDOWS\web\related.htm and the file of course is called `related.htm`
If you locate this file and choose "edit" you see what it can do, here is the actual script;
---------------------------------------------
<script>

//Build the query
userURL=external.menuArguments.location.href;
RelatedServiceURL="http://related.msn.com/related.asp?url=";

//Perform simple check for Intranet URLs
//this is where the http or https will be, as found by searching for :// but skip res:
protocolIndex=userURL.indexOf("://",4);
serverIndex=userURL.indexOf("/",protocolIndex + 3);
urlresult=userURL.substring(0,serverIndex);

//Check if Intranet URL - then open search bar

if (urlresult.indexOf(".",0) < 1) userURL="Intranet URL";
finalURL = RelatedServiceURL + escape(userURL);
external.menuArguments.open(finalURL, "_search");

</script>
---------------------------------------------
So far safe enough, but how does Alexa DIRECTLY!!! "relate" to the registry Keys and this script, that IS a microsoft file.
Quite simple it does not, and if you click on this link
http://related.msn.com/related.asp?url=

you are redirected to a `Frame` located at this link
http://xslt.alexa.com/data?cli=16&url=

So if you want to delete the Key, its ok, but you will nolonger have the "Related" toolbar (see Tools>Show Related Links)on browser.
If you cannot access the below link, I wonder who can?.
http://client.alexa.com/

[This message has been edited by lukeg (edited 01-16-2002).]

Show 40 post(s) from this thread on one page