185912 - Bloodhound virus in Mozilla 1.2.1 installer file which kills Windows 98

Status: RESOLVED WORKSFORME

(mozilla.org :: FTP: Staging, task)

Description

[ferkada]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.0) Gecko/20020530
Build Identifier: Mozilla 1.2.1 on Windows 98

A friend of mine got the 1.2.1 version of Mozilla.  He got in through the file
on the site and after installing it Norton AntiVirus said there was a Bloodhound
virus or some such.  It made it such that starting up the computer brought it to
the desktop but in a not-working state.  After formatting his hard drive and
reinstalling Windows he attempted to get it through the web install, apparently,
and the same end-result was met.  

Reproducible: Didn't try

Steps to Reproduce:
1.  Download the installer on a Windows system running active antivirus software.
2.  Effect the installation.
3.  Attempt to run the program.  Along the way the virus should be caught.

Actual Results:  
Quarantine and deletion of the file successful.  However, the computer soon
locked up and, upon rebooting, the desktop was reached but nothing worked
correctly.  It is suspected that my friend's system files were corrupted,
forcing drastive corrective measures.

Expected Results:  
There should not be a virus.  Mozilla should not mess up one's computer.

Installer/installation package/archive.

Comment 1

[Matthias Versen [:Matti]]

From where do you got this file ?

The file from the mozilla homepage and the mozilla ftp contains no virus.
(checked with Mcafee Virus scan)

There are 3 possible reasons for this :
a) you got a infected file from somewhere else
b) The file got infected on your HDD
c) wrong alert from the virus scanner.

This page indicates that this is caused by heuristic scan and it could be a
false psoitive (wrong alert)
http://www.fdos.org/freedos/news/technote/159.html

Comment 2

[Benedikt Kantus]

Since nobody else detected this virus, I guess it's true that the original
mozilla.org files are not infected.

So this bug report should be resolved WORKSFORME.

Comment 3

[Matthias Versen [:Matti]]

-> wfm