Latest Ad-Aware Signaturefile: 241-14.01.2002

Quote:

---

Originally posted by Mowergun:
Like the rest of you, I found three ezula registry keys with adaware after installing the latest reflist. After reading up on ezula and searching my machine for stub.exe, ezstub.exe, and ezulaboot.dll and finding nothing, I am beginning to wonder if the ezula stuff could be imbedded or hidden within the executable files of some other popular program. Is this possible? For example, I have long suspected that something within Netsurfer.exe phones home whenever I go online.

Just a thought.

Mowergun

---

YES. (via the registry it can execute script or installed applications, etc...)
If you got eZula you got eZula, I can live without it, what is it anyway?, I just just check, ta.

Quote:

---

Originally posted by IMM:
I haven't really looked at source for all the keys but the UUID
{618736e0-3c3d-11cf-810c-00aa00389b71}
is placed in HKR (several locations) by office 97 installs. One example is:
HKEY_CLASSES_ROOT\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}

The original install of office97 doesn't place this uuid in
HKEY_LOCAL_MACHINE\software\classes\interface\
or any other HKLM key as far as I know on the install but interactions with other stuff?

Be interesting to follow this.

[This message has been edited by IMM (edited 01-14-2002).]

---

Precisely...

I did a reg scan and found (1) entry for ezula.. deleted it of course.. I don't attend nor download music, for that matter I don't even run lavasoft that much anymore.. hmmm so where else could I get that? I wonder if it has to do with web pages that require cookies be accepted and referrers enabled.

mach

Quote:

---

Originally posted by discogail:
There's a little bit of talk around re: MS accessibility Aids.
One post on Grc.......
"Did a search thru registry for ONLY ONE of the keys found
by Ad-Aware.

This one: EzuLa
key:HKEY_LOCAL_MACHINE\software\classes\typelib\{1ea4dbf0-3c3b-11cf-810c-00a
a00389b71}\

OK, now here is a SMALL part of that one particular key:
[HKEY_LOCAL_MACHINE\Software\CLASSES\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00
389B71}\1.1\0\win32]
@="oleacc.dll"

OK, next I did a Find for oleacc.dll and this is the result of that:
Something about "Active Accessability Core Component"....

A followup offered:
"Active Accessibility is
used by adaptive equipment to access information on the computer. For instance
I work with people who are blind and visually impaired and they often use
programs like JAWS, Simply Talker or ZoomText to read the text on the screen."

And:
Microsoft® Active Accessibility® is a developer technology that improves the way programs and the operating system work with accessibility aids. Active Accessibility can help software developers make their programs more compatible with accessibility aids, and accessibility aid developers can make more reliable and robust aids.

As an underlying technology, Active Accessibility is invisible to users. Active Accessibility, used by developers since 1997, may already be in the operating system and programs you use today. For example, Active Accessibility is in Microsoft Office 97 and Office 2000, Microsoft Windows® 98 and Windows 2000, and Microsoft Internet Explorer 3.0, 4.01 and 5.

http://msdn.microsoft.com/library/de.../html/msaa.asp

---

Hello, I got the oleacc.dll file and accessability options installed (control Panel), but NO registry UUID for this Value or Key or whatever it is...nor the other two (2) related to Ezula via Ad-aware (well ref sig 14-1-2002 that was).
Using ref sig file version 14-1-2002 or 16-1-2002 I find no such keys, nor have very time consuming searches of the registry found ANYTHING, are you sure Ezula does not phone home???, using a 3rd or 4th party application, real player whatever, ie sublet Key UUID-functions scam, sig file 16-1-2002 maybe attempting to cover/these/there/this tracks.
>>>>clue$$$$$?.

Quote:

---

Originally posted by MACH2:
I did a reg scan and found (1) entry for ezula.. deleted it of course.. I don't attend nor download music, for that matter I don't even run lavasoft that much anymore.. hmmm so where else could I get that? I wonder if it has to do with web pages that require cookies be accepted and referrers enabled.

mach

---

No idea MACH2 how you let it get in, however we can all relax now because guess what;
"eZula, Inc. does not collect, share or sell any identifiable information about individual users. Please Read our complete Privacy Policy. http://www.ezula.com/TopText/Privacy.asp
Copyright © 2001 eZula, Inc".

Although it does not say that they do not lie or decieve, so how can we believe them?.

Control Panel> Add/Remove Programs> Windows Setup> Accessibility> Details> "Accessibilty Options" AND "Accessibilty Tools" are both listed, however I have not got the "Tools" ticked.
That is to say, I do not have the Magnifyer, etc, that eZula uses/abuses??, not that, that one, bothered me, it was this little known ability to exploit "sticky Keys" to do key stroke logging that got me, if they only knew how slowly I type, even after 2 years practice, that would be PERSONAL right?, whether or not it is associated with personally identifyable information about the user (me) under the/their Privacy agreement, we are all just numbers in the system anyway.
ie person 13467538858/00800OfffG@qwd/??, is a complete fool, nothing PERSONAL?.sure, anything you say...




[This message has been edited by lukeg (edited 01-17-2002).]

lukeg regarding the detection scheme - I made a directory called ezula to save some info in (html and text mostly) and Ad-Aware flagged the folder for deletion (altho' the contents were innocuous).