Adware in Zimbra !!!

[peterkuramapu]

I am new Zimbra Desktop user.
I use a Mac Book. When I use Safari browser and try to send a link to the current page to an email recipient a "pop up" add appears.
for InterNeTT Services. It hijacks the Zimbra desktop and will not go away. I have to restart Zimbra.

I already run popup blockers and Sophos antivirus software but these do not seem to stop the Zimbra desktop jumping to the advertisement.
I have attached a picture copy of the advert below.

How do I get rid of the ad and check to see if anything else is lurking under the "hood"?

With thanks in advance,

Peter
Zimbra so far? It is a bit light on the import and export facilities (no .csv, .eml or .pst) but otherwise I think it is amazing.

[Rom]

Is this repeatable? Can you try it on another Mac (with a brand new download, of course)? It could be local to your system... I would be amazed if this had slipped in to Zimbra Desktop.

Thanks!

S.

[jholder]

I can say with 100% certainty that this is not ours. It's either on your mac, or from your ISP.


Besides, if we were gonna do ads (which we aren't), we'd make a page that looks like a professional made it, and not a 10 year old.

[peterkuramapu]

Hi.
The ad is fairly ropey I'll agree. Not going to win any business here (thank goodness). I wonder what the company knows about it?

I won't install Zimbra Desktop on my other Mac until I know its safe.

Originally I downloaded and installed ZD on 3 separate machines: Mac, windows and Linux at the same time. The others are fine. (and look good :-))

I dont know if the copy of ZD for Mac came from a mirror site if so which?

After a few tests I now know:
i. It only happens when Zimbra is running, not when Mac Safari browser has to fire up Zimbra.
ii. It does not happen when Safari is set to use any of my other email clients (tried Mac Mail, Thunderbird & Opera).
iii. It does not happen when I use Zimbra as a mail client with other browsers (firefox or Opera)

Just a Mac Safari+Zimbra problem?

Next step:
When I have time, Backup my Mac., then re-install ZD. If the problem goes away I'll do a difference check between the old and new files to see if any are different.
Not sure what else to do.
If I can repeat the problem what shall I do with the installation file (do you want it?)

Ideas?
Thanks,

PK

[iggy]

Build 1537 md5 is 8e6efd8596754a92bbc347f02f334b5f.

[jmurthy]

I get this same web page. I went to
snopes.com: Interview with Bjarne Stroustrup About C++
and click on the "email this" link. It gives me a choice of applications and I used Zimbra Desktop.
This page pops up repeatably.

Max OSX 10.4.11

[Grahamm]

I get the same ad: ZD 1.0.3 (1696)
Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-GB; rv:1.9.0.1) Gecko/2008072406 Prism (zdesktop/1.0.3)

It's a pain, and a service that I use a lot on the mac. The MAC service passes the details to ZD, which then quits and the pop-up add appears.

I'd ve surprised if all three people seeing this ad have the same ISP (Virgin Broadband for me), so I think that it must be something to do with ZD.

The URL of the ad is something like URL REMOVED

Any fixes to this likely?

Thanks

Graham

[Dirk]

I've removed the link to the page you are getting as it's possibly a malicious site. The site is NOT coming from any Zimbra product. I strongly recommend that you check you system for virus/malware.

Better still, blow away your partition, install the OS from scratch, install Zimbra and see if it still happens.

[jmurthy]

I'm not ready to reinstall OSX just to check this but I'm reasonably sure that I have no virus or malware. I'll try again when I get a new computer. Could there be some misspelling of "internet" somewhere that diverts to "internett"?

Note that these are three completely different users with different ISPs. The commonalities are Zimbra and OSX.

[peterkuramapu]

Hi, Back again :-(
Using my white Macbook today. I tried to send a webpage link again and got the same annoying adware pop up from Zimbra desktop.
I tried my other Silver Mac book pro and got the same pop up.

This is definitely Zimbra desktop problem.
While it IS annoying and IS related to Zimbra; my main concern is the underlying security.

If Zimbra can be hijacked, then what else is going on without our knowledge?

Sticking our heads in the sand saying "Oh no, it cannot possibly be Zimbra" is not the right thing to do.
What can we do to track the problem down? Developers. Any ideas?
Are there any "trace" programs that we can run time while using Zimbra?

Thanks,
Peter