Presumably by saying "it wants to act as a server", that means that it's opening either:

1. Listening TCP sockets
2. UDP sockets

The browser might legitimately do the second.

I've looked at the ports before / after mozilla is opened on my machine, and it opens no sockets at all as far as I can tell (my home page is a local HTML page)

Does zone alarm provide more details?

AFAICT, the two possibilities are:

1. Your copy of mozilla is trojaned and it is genuinely trying to start a server for nefarious purposes
2. Zonealarm is lying, and is falsely detecting something else that mozilla is legitimately doing as a server

IMHO, number 2 is more likely - especially if you obtained mozilla from a secure source.

Of course there might be something funny like plugins causing this to happen too ... I really don't know enough about your configuration to tell.

Slarty