Powerpoint file accesses the web, how, where, what, why ?

[Joey]

I received a powerpoint presentation that, when I first open it,
accesses the web. Kerio firewall tells me that :
'POWERPNT.EXE' from your computer wants to connect to xxxxxx.com
[123.123.12.12], port 80

After several minutes of viewing, it tries again (I get another Kerio
popup.)

How can I find out what/where in this presentation is calling out to
the website? This is a .ppt file, so I *probably* have access to the
raw programming...???

I am very computer literate, but have never used powerpoint. Any help
or suggestions would be very appreciated. Thanks.

 

[Mike M.]

Edit the PowerPoint file (either double click the .ppt or open PowerPoint
and open the file). Check each slide for images, sounds or video clips that
might be linked from the web. Try right clicking on each shape (image,
sound, whatever) and checking it's properties. Something in there came from
a web site.

 

[Steve Rindsberg]

I received a powerpoint presentation that, when I first open it,
accesses the web. Kerio firewall tells me that :
'POWERPNT.EXE' from your computer wants to connect to xxxxxx.com
[123.123.12.12], port 80

After several minutes of viewing, it tries again (I get another Kerio
popup.)

How can I find out what/where in this presentation is calling out to
the website? This is a .ppt file, so I *probably* have access to the
raw programming...???

Sounds as though there might be an image linked to a picture on the web.
Our free FixLinks demo includes a report tool that'll list the links in your
PPT presentation; that might help you track it down.

http://www.pptools.com


--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[clea]

I used your FIXLINKS tool and it reports that there are no links!!
Any other ideas on how it could be accessing the web?

(Note: it was quite a trick to download the demo, your links don't work, i
had to type in ftp:\\ and find the directory, then copy/paste to my hard
drive.)
...............................................
This DEMO reports all links but only repairs image links.
To repair other link types, please register FixLinks Pro
at http://get.pptools.com

LINKED PICTURES, SOUNDS, MEDIA; SHAPES WITH ACTION SETTINGS
Slide ShapeName Mouse Status Link Type
===== ========= ===== ====== =========
5 Picture 5 M/C N/A embedded picture
File: Embedded; no link

ACTION SETTINGS ON TEXT WITHIN SHAPES
Slide ShapeName Mouse Status Link Type
===== ========= ===== ====== =========
HYPERLINKS
Slide ShapeName Status Link
===== ========= ====== =====
TRANSITION SOUNDS
=================
(NOTE: transition sounds are always embedded, not linked.)

Approximate link storage: 0 bytes
.................................................

I received a powerpoint presentation that, when I first open it,
accesses the web. Kerio firewall tells me that :
'POWERPNT.EXE' from your computer wants to connect to xxxxxx.com
[123.123.12.12], port 80

After several minutes of viewing, it tries again (I get another Kerio
popup.)

How can I find out what/where in this presentation is calling out to
the website? This is a .ppt file, so I *probably* have access to the
raw programming...???

Sounds as though there might be an image linked to a picture on the web.
Our free FixLinks demo includes a report tool that'll list the links in your
PPT presentation; that might help you track it down.

http://www.pptools.com

 

[Joey]

Edit the PowerPoint file (either double click the .ppt or open PowerPoint
and open the file). Check each slide for images, sounds or video clips that
might be linked from the web. Try right clicking on each shape (image,
sound, whatever) and checking it's properties. Something in there came from
a web site.

Thanks for the suggestion. This was the first thing I tried. I right
clicked on everything, looking for something in the hyperlink field.
All was empty.
This was confirmed by using the PPTools tool FixLinks.

Any other ideas? Can a script be embedded inside the .ppt somewhere?

 

[Steve Rindsberg]

I used your FIXLINKS tool and it reports that there are no links!!
Any other ideas on how it could be accessing the web?

I'm assuming the IP address you quoted before was a dummy, not the real one the
firewall's reporting. What's the real address or domain?

Do you get the same alarm when you just start PPT up on its own, no files
loaded? Some versions do attempt to connect to the net on startup.

Do you have an AV program running and does it have an office scan feature?
That might be triggering a network connect attempt.

(Note: it was quite a trick to download the demo, your links don't work, i
had to type in ftp:\\ and find the directory, then copy/paste to my hard
drive.)

Thanks for letting me know you had trouble with this. Does your firewall have
any say in EXE downloads? I suspect that might be the problem here, because
thousands of people a month download these things and this is the first time
I've heard this complaint in five years or more.

...............................................
This DEMO reports all links but only repairs image links.
To repair other link types, please register FixLinks Pro
at http://get.pptools.com

LINKED PICTURES, SOUNDS, MEDIA; SHAPES WITH ACTION SETTINGS
Slide ShapeName Mouse Status Link Type
===== ========= ===== ====== =========
5 Picture 5 M/C N/A embedded picture
File: Embedded; no link

ACTION SETTINGS ON TEXT WITHIN SHAPES
Slide ShapeName Mouse Status Link Type
===== ========= ===== ====== =========
HYPERLINKS
Slide ShapeName Status Link
===== ========= ====== =====
TRANSITION SOUNDS
=================
(NOTE: transition sounds are always embedded, not linked.)

Approximate link storage: 0 bytes
.................................................

I received a powerpoint presentation that, when I first open it,
accesses the web. Kerio firewall tells me that :
'POWERPNT.EXE' from your computer wants to connect to xxxxxx.com
[123.123.12.12], port 80

After several minutes of viewing, it tries again (I get another Kerio
popup.)

How can I find out what/where in this presentation is calling out to
the website? This is a .ppt file, so I *probably* have access to the
raw programming...???

Sounds as though there might be an image linked to a picture on the web.
Our free FixLinks demo includes a report tool that'll list the links in your
PPT presentation; that might help you track it down.

http://www.pptools.com

--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[clea]

I'm assuming the IP address you quoted before was a dummy, not the real one the
firewall's reporting. What's the real address or domain?

Yes, I "dummied" it. The actual address is a competitor of my company,
hence my suspiciousness!!!! (A company that has nothing to do with
microsoft, or powerpoint tools, or any software helper app, or anything at
all like that.)

Do you get the same alarm when you just start PPT up on its own, no files
loaded? Some versions do attempt to connect to the net on startup.

No alarm from PPT on its own.

Do you have an AV program running and does it have an office scan feature?
That might be triggering a network connect attempt.

Yes, AV running on a corporate network, I'm sure it does have office scan
feature. But it would NOT intentionally go to a competitors website...

Thanks for letting me know you had trouble with this. Does your firewall have
any say in EXE downloads? I suspect that might be the problem here, because
thousands of people a month download these things and this is the first time
I've heard this complaint in five years or more.

I don't *think* so... It appears that the download demo links on this page
http://www.rdpslides.com/pptools/FAQ00026.htm
point to files that aren't actually there. I found them, and copied them,
from
ftp://www.rdpslides.com/pptools/

 

[Mike M.]

Have you checked to see if there are any macros in the presentation?
Tools->Macros.

 

[clea]

I don't see anything listed in there, either.
thanks.
any more ideas?

 

[Steve Rindsberg]

Yes, I "dummied" it. The actual address is a competitor of my company,

hence my suspiciousness!!!!

That puts it in a different light, certainly!
As you've figured out, that pretty well shoots down the usual reasons for net
access.

It'd be interesting to see if you can narrow it down to a particular slide or
slides (make a couple copies of the presentation, delete the first half of the
slides in one, the second half in the other, save and see if either or both
exhibit the problem. Then keep dividing until you can isolate a slide with the
problem from the others. And if you can, I'd be *very* interested in seeing
it.)

I don't *think* so... It appears that the download demo links on this page
http://www.rdpslides.com/pptools/FAQ00026.htm
point to files that aren't actually there. I found them, and copied them,
from
ftp://www.rdpslides.com/pptools/

Weird. I've checked it a couple times today and it's worked fine. It might
have been a temporary glitch at the network or server end, I suppose.


--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[clea]

Wow, thank you for this suggestion!
Until now, I had always been opening it from my Outlook inbox.
So now I saved it to my hard drive, NO MORE POPUP WARNINGS!
The warnings only come when i open it directly from outlook, so it must be
some script embedded in the forwarded email!!! Maybe it is tracking who is
getting the email, and who opens it, etc.
So I guess this means that the .ppt file is fine, but I need to decipher the
email message now.
Is it time to do some asking in a different newsgroup...??
Thanks a lot for the help.
(now i really have to figure this one out: either we have a spy employee, or
an employee got his PC hacked into, or his email corrupted somehow.)

 

[clea]

I got too excited from this that I forgot that the popup says "POWERPNT.EXE"
is trying to access blahblah.com.
So, for some reason it does not access when I open from the hard drive, but
it accesses when I open it from outlook.
Hmmm...

Maybe something gets lost just from the simple act of me clicking SAVE to
put in on my hard drive??

thanks

 

[Mike M.]

You might want to post the question in the Outlook Express NG.

 

[Steve Rindsberg]

Wow, thank you for this suggestion!
Until now, I had always been opening it from my Outlook inbox.
So now I saved it to my hard drive, NO MORE POPUP WARNINGS!
The warnings only come when i open it directly from outlook, so it must be
some script embedded in the forwarded email!!! Maybe it is tracking who is
getting the email, and who opens it, etc.
So I guess this means that the .ppt file is fine, but I need to decipher the
email message now.
Is it time to do some asking in a different newsgroup...??
Thanks a lot for the help.

Any time. After seeing your other msg, I still wonder whether there's
something in the email that triggers the connection attempt.

I don't use Outlook - is there some way to view the email content as plain text
rather than as whatever formatted/html'd/thing it normally shows you?



--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[clea]

Steve - the reason I couldn't easily download from your website: BLACK ICE!
The previous day, I had installed some company software that secretly
installed a copy of Black Ice. After I couldn't download several other
files, I began to investigate, and found the Black Ice installer in a
company folder... So, your website was fine, it was my end.
thanks.

I still don't know what could be happening with the powerpoint presentation.
I don't get the warning when i open it from the hard-drive, only when I open
it from the email attachment.

 

[clea]

I forwarded it to a webmail account, and forwarded it back, and it still
does it.

I suppose there is a chance that *my* machine is somehow affected and doing
this???

 

[Steve Rindsberg]

Steve - the reason I couldn't easily download from your website: BLACK ICE!
The previous day, I had installed some company software that secretly
installed a copy of Black Ice. After I couldn't download several other
files, I began to investigate, and found the Black Ice installer in a
company folder... So, your website was fine, it was my end.
thanks.

Ah, that feels SO much better. Thanks for taking the time to check it out AND
to let me know.

I still don't know what could be happening with the powerpoint presentation.
I don't get the warning when i open it from the hard-drive, only when I open
it from the email attachment.

I saw the other post (about forwarding it back to yourself). I don't think
that'd necessarily indicate a problem at your end, since you'd just be
receiving the same email as you originally got; if the problem's with the
email, it'll stay with the email.

It'd be worth asking in the Outlook group to see whether a) they've heard of
anything like this and b) the other thing that I though of but forgot while I
was typing a) ... OH! To see whether they know of any way to export the email
content as plain text.

Or for that matter, if you want to forward the email to me at steve atsign
steverindsberg period com I'll have a look (with the understanding that it will
not be passed along or shared with anyone from here).



--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[Guest]

I know that sometimes PPT will trigger the trip to the web if someone's copied an image and then pasted it into PPT. It seems that some of the HTML tags or the URL or whatever can get included with the paste, and that triggers the web access.

I don't know that this would trigger as an actual link using FixLinks. Steve would have to fill me in on that.

I'd probably save the file as HTML and then view it in IE to see if the source info has any oddball URLs in them.

I'd probably try the same thing with the Outlook email itself. Save as a TXT file and then see if there's anything in the HTML code which points to the competitor site. I don't know much about this, but there are 1-pixel tracking gifs and things like that which may be the source of the problem.

--
Echo [MS PPT MVP]
http://www.echosvoice.com
presenter, PPT Live '04
Oct 10-13, San Diego http://www.powerpointlive.com

 

[Steve Rindsberg]

I know that sometimes PPT will trigger the trip to the web if someone's copied an image

and then pasted it into PPT. It seems that some of the HTML tags or the URL or whatever can
get included with the paste, and that triggers the web access.

I don't know that this would trigger as an actual link using FixLinks. Steve would have

to fill me in on that.

I don't really know either; that's one reason I'm so interested in following this up. I've
never gotten hold of a presentation that triggers this behavior or been able to create one.
Sure would like to!


--
Steve Rindsberg, PPT MVP
PPT FAQ: www.pptfaq.com
PPTools: www.pptools.com
================================================
Featured Presenter, PowerPoint Live 2004
October 10-13, San Diego, CA www.PowerPointLive.com
================================================

 

[clea]

I saved as html, and this is all it saved. It must be referencing the
actual material from somewhere else, because this html file is only 3k, but
the attachment is close to 1M.
How does it know where to find the 2004 NSM Breakout v2b.htm file? that
might shed some light on this.

=======================
<html>

<head>
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta name=ProgId content=PowerPoint.Slide>
<meta name=Generator content="Microsoft PowerPoint 9">
<link id=Main-File rel=Main-File href="../2004%20NSM%20Breakout%20v2b.htm">
<link rel=Preview href=preview.wmf>
<title>Title Here</title>
<![if !ppt]><script src=script.js></script><script>
<!--
var gNavLoaded = gOtlNavLoaded = gOtlLoaded = false;
function Load()
{
str=document.location.hash,idx=str.indexOf('#')
if(idx>=0) str=str.substr(1);
if(str) PPTSld.location.replace(str);
}
//-->
</script><![endif]>
</head>

<frameset rows="*,25" frameborder=0>
<frameset cols="20%,80%" id=PPTHorizAdjust framespacing=2>
<frame src=outline.htm name=PPTOtl>
<frameset rows="100%,*" id=PPTVertAdjust framespacing=2 frameborder=1
onload="Load()">
<frame src=slide0001.htm name=PPTSld>
<frame src=slide0001.htm name=PPTNts>
</frameset>
</frameset>
<frameset cols="20%,80%" framespacing=2 frameborder=0>
<frame src=outline.htm name=PPTOtlNav scrolling=no noresize>
<frame src=outline.htm name=PPTNav scrolling=no noresize>
</frameset>
</frameset>

</html>
=====================

I'd probably save the file as HTML and then view it in IE to see if the

source info has any oddball URLs in them.

I'd probably try the same thing with the Outlook email itself. Save as a

TXT file and then see if there's anything in the HTML code which points to
the competitor site. I don't know much about this, but there are 1-pixel
tracking gifs and things like that which may be the source of the problem.

--
Echo [MS PPT MVP]
http://www.echosvoice.com
presenter, PPT Live '04
Oct 10-13, San Diego http://www.powerpointlive.com