Cal,
Here's a list of the keys that we're checking for Mozilla.  The ones  
for Firefox are almost the same, but it seems that Mozilla is  
problematic (see below).

Checks
regMozillaExists
HKLM\SOFTWARE\mozilla.org\Mozilla\        exists

fileMozillaExists
SYSTEM_PROGRAMS\mozilla.org\Mozilla\mozilla.exe            exists

regMozillaCurrent
HKLM\SOFTWARE\mozilla.org\Mozilla\CurrentVersion    string    starts  
with    1.7.12

Rules
MozillaNeedsUpdate (Version 1)
!regMozillaExists | (regMozillaExists & regMozillaCurrent)

MozillaNeedsUpdate (Version 2)
!(regMozillaExists & fileMozillaExists) | (regMozillaExists &  
fileMozillaExists & regMozillaCurrent)


The problem is, some versions of Thunderbird sometimes, but not  
always, create a HKLM\SOFTWARE\mozilla.org\Mozilla\CurrentVersion  
key.  Depending on the version of Thunderbird installed, this could  
be wildly out of date, and so version 1 of the rule makes them  
install Mozilla when they didn't have it installed before.

Unlike Firefox, Mozilla does not create a generic key in HKLM\SOFTWARE 
\Mozilla\  that you can test to see if it's installed.

I'm testing version 2 of the rule on some of my coworkers right now  
to see what happens.

Michael Grinnell
Network Security Administrator
The American University
e-mail: [log in to unmask]


On Oct 5, 2005, at 5:30 PM, Calvin A. Krzywiec wrote:

> What registry keys are you currently checking?
>
> Cal A. Krzywiec
> Residential Network Consultant
> The University of Scranton
> Email: [log in to unmask]
> Phone: 570-941-6960
>
> -----Original Message-----
> From: Perfigo SecureSmart and CleanMachines Discussion List
> [mailto:[log in to unmask]] On Behalf Of Michael Grinnell
> Sent: Wednesday, October 05, 2005 4:59 PM
> To: [log in to unmask]
> Subject: Mozilla or Firefox checks
>
> We're trying to create rules that will catch users running older
> versions of Mozilla or Mozilla Firefox so that we can make them
> upgrade.  I'm having problems creating appropriate rules due to the
> way Mozilla, Mozilla Firefox, and Mozilla Thunderbird create registry
> keys.  In particular, I keep getting false positives on my check for
> Mozilla when some users have certain versions of Thunderbird or
> Firefox.  Unfortunately, I'm having trouble replicating these issues
> in my test environment, which makes it very difficult to fix the  
> rules.
>
> Has anybody tried doing rules for Mozilla or Firefox before, and if
> so, would you be willing to share them?
>
> Michael Grinnell
> Network Security Administrator
> The American University
> e-mail: [log in to unmask]
>