How do I get more information on an Active X prompt

[Guest]

I am running Win XP Pro SP2 with IE 6.0 SP2. I have customized my Internet
Zone from Medium to Prompt Signed Active X and Disable Unsigned Active X. My
question is, How do I find out what an ActiveX program is attempting to do
and which site it's coming from when I get the prompts. Sometimes it seems
that the site I am going to needs the ActiveX to work properly and at other
times it's the advertisers on the site the are sending the ActiveX.

Thank you for any assistance you can provide.

 

[Jon Kennedy]

In IE go to Help...Content and Index, Search tab. Search for "ActiveX" and
read the numerous topics there for more info about ActiveX and security.

 

[Guest]

Thanks for the quick response, Jon. I looked in the suggested location and
saw a number of articles that I hadn't already looked at. Most of them I had
looked into, along with the 'Related' listings, prior to my post. For
instance in 'Should you install ActiveX controls?" the recommendation is to
ask the question 'Do you know what the control is for and what it will do to
your computer?' Though the suggestion is made I was unable to locate any
information on how to determine what the control is for and what it will do
to my computer. Thus the post. Some of the articles say that the site
should make this information available prior to requesting the download of
the code. While that may be true, I have not seen that on any of the dozens
of sites, many from well established companies with considerable content,
that I have been to this week that prompted for a Control that had been
signed. When I answered NO to see what the page would do and found that the
page wouldn't work at all without the Control I was later unable to load the
page because IE had marked it as a threat, apparently on the basis of my
earlier denial. Lacking a better solution, I marked those sites that I
wasn't afraid of as Trusted so that i could accomplish my purpose for
visiting the site in the first place.

Sorry the post is so long but it didn't seem clear that I wasn't just
posting without trying to get the information first. I hope to get a reply
if you would like to continue the dialog or if anyone else has a suggestion.

 

[Robert Aldwinckle]

I am running Win XP Pro SP2 with IE 6.0 SP2. I have customized my Internet
Zone from Medium to Prompt Signed Active X and Disable Unsigned Active X. My
question is, How do I find out what an ActiveX program is attempting to do
and which site it's coming from when I get the prompts. Sometimes it seems
that the site I am going to needs the ActiveX to work properly and at other
times it's the advertisers on the site the are sending the ActiveX.

Good question which demonstrates a big deficiency in the prompts IMO.

FWIW what I do is use a variety of tools including View Source (e.g Alt-V,c)
the TIF Viewer, (e.g. Alt-T,O,Alt-S,V) FileMon and FiddlerTool to compensate.
Because the prompt blocks access to the View menu we either have to use
one of those other tools to inspect the source or reply No on a first pass. Etc.

Thank you for any assistance you can provide.

Do you have a specific site in mind which could be used as an example
to facilitate further discussion?


HTH

Robert Aldwinckle
---

 

[Guest]

Thank you for your response, Robert. I have included a few of the links that
I have come accross in the last day or two for your review. I also devided
into sites that won't work at all without the Active X and those that will.

Some examples of sites that won't work without the ActiveX:
- http://www.capitalone.com
- https://www.caremark.com/ (I don't see the Active X until after I log on)

And these that will work without the Active X.
- http://www.computing.net/windows95/wwwboard/forum/5241.html
- http://www.csgnetwork.com/ipdisplaydet.html
- http://www.google.com/support/toolbar/?quick=versioninfo
- http://www.microcenter.com/

There are quite a few more but I thought that was a good start. I am not
familiar with any of the tools that you mentioned and they will each have to
be evaluated for the envioronment in which I work before I can install them
I have more control over my home system but still have to be careful of doing
things that could impact the other family members. Would you be able to
provide links to the sites that provide these tools so that I can start
gathering information on them? If not, I'll Google them and see what I come
up with. I am also unfamiliar with IMO and FWIW. Would you mind elaborating
on those a bit or pointing me to a site where I can get more familiar with
them?

Thanks again for the help.

 

[Robert Aldwinckle]

Thank you for your response, Robert. I have included a few of the links that
I have come accross in the last day or two for your review. I also devided
into sites that won't work at all without the Active X and those that will.

Some examples of sites that won't work without the ActiveX:
- http://www.capitalone.com

Won't work in what way? All that I see is a Shockwave Flash ad.

- https://www.caremark.com/ (I don't see the Active X until after I log on)

I don't want to log on but I do see prompts with just the home page.
More Shockwave Flash. Hint: if you see lots of rapidly changing
complex images, right-click on it and see if you get a Flash command menu.

And these that will work without the Active X.
- http://www.computing.net/windows95/wwwboard/forum/5241.html

That's neat. If ActiveX is enabled you get a Shockwave Flash ad;
otherwise you just get a .gif banner ad.

- http://www.csgnetwork.com/ipdisplaydet.html

There is a difference. If ActiveX is enabled they tell you your version
of Shockwave Flash. ; )

- http://www.google.com/support/toolbar/?quick=versioninfo

This one made me regret not having a script debugger installed
on this partition. That's another tool I should have mentioned
in my first reply obviously. And this was the only one I had to
resort to using FiddlerTool for. I think the issue is that the page
has a link to a non-cacheable diagnostic script called urchin.js (?)
which contains this routine:

<extract>
function _uFlash() {
var f="-",n=navigator;
if (n.plugins && n.plugins.length) {
for (var ii=0;ii<n.plugins.length;ii++) {
if (n.plugins[ii].name.indexOf('Shockwave Flash')!=-1) {
f=n.plugins[ii].description.split('Shockwave Flash ')[1];
break;
}
}
} else if (window.ActiveXObject) {
for (var ii=10;ii>=2;ii--) {
try {
var fl=eval("new ActiveXObject('ShockwaveFlash.ShockwaveFlash."+ii+"');");
if (fl) { f=ii + '.0'; break; }
}
catch(e) {}
}
}
return f;
}
</extract>


Notice the try ... catch above. That would be where
the prompt would be occurring I think.
Again, I expect that a script debugger would make this
analysis much simpler. E.g. I wouldn't have had to resort
to using FiddlerTool to see the source. ; }

More importantly though it would be much more comforting
actually seeing this code used. E.g. in case there was something
else being executed which I had overlooked.

- http://www.microcenter.com/

More Macromedia Flash. (The Verisign Secured Seal at the bottom left.)
This one was hard to spot because it isn't coded conventionally.
E.g. often it is sufficient just to open View Source and do a find for .swf
This could be another example which would have been much easier
to identify using a script debugger. E.g. the HTML which renders the
Flash image is enclosed by <script> tags, so I would assume that
a script debugger might be invoked when it is rendered.


BTW here's a link to a blog page which discusses script debugging
in a bit more detail (courtesy Dave Massy [MSFT])

http://blogs.msdn.com/ie/archive/2004/10/26/247912.aspx

There are quite a few more but I thought that was a good start. I am not
familiar with any of the tools that you mentioned and they will each have to
be evaluated for the envioronment in which I work before I can install them
I have more control over my home system but still have to be careful of doing
things that could impact the other family members. Would you be able to
provide links to the sites that provide these tools so that I can start
gathering information on them? If not, I'll Google them and see what I come
up with.

Did I mention SysInternals? Oops. No I didn't. That's the site name
where you would get FileMon and RegMon. Actually it turns out I didn't
have to use them with these examples but they are both really useful tools
for many bits of analysis.

FiddlerTool has its own site and an affiliation with Microsoft
since it was written by Eric Lawrence, a Microsoft employee.

I am also unfamiliar with IMO and FWIW. Would you mind elaborating
on those a bit or pointing me to a site where I can get more familiar with
them?

New to newsgroups? ; ) Search keyword would be acronyms

http://www.freewarehof.org/acronyms.html

(Google web search for
IMO FWIW inurl:acronyms
)

Thanks again for the help.

Happy to help <w>

Robert
---

 

[Guest]

Thanks for the class, Robert. From what you've shown me I will have to learn
several different programming techniques and languages to figure out what's
going on with these ActiveX and other types of scripts. Thank you also for
pointing out some resources that would help me to learn these techniques. I
hope I'll get it figured out before I end up crashing my systems on some bad
code ;o) whether it's malicious or just poorly written.
--
PM-S

Thank you for your response, Robert. I have included a few of the links that
I have come accross in the last day or two for your review. I also devided
into sites that won't work at all without the Active X and those that will.

Some examples of sites that won't work without the ActiveX:
- http://www.capitalone.com

Won't work in what way? All that I see is a Shockwave Flash ad.

- https://www.caremark.com/ (I don't see the Active X until after I log on)

I don't want to log on but I do see prompts with just the home page.
More Shockwave Flash. Hint: if you see lots of rapidly changing
complex images, right-click on it and see if you get a Flash command menu.

And these that will work without the Active X.
- http://www.computing.net/windows95/wwwboard/forum/5241.html

That's neat. If ActiveX is enabled you get a Shockwave Flash ad;
otherwise you just get a .gif banner ad.

- http://www.csgnetwork.com/ipdisplaydet.html

There is a difference. If ActiveX is enabled they tell you your version
of Shockwave Flash. ; )

- http://www.google.com/support/toolbar/?quick=versioninfo

This one made me regret not having a script debugger installed
on this partition. That's another tool I should have mentioned
in my first reply obviously. And this was the only one I had to
resort to using FiddlerTool for. I think the issue is that the page
has a link to a non-cacheable diagnostic script called urchin.js (?)
which contains this routine:

<extract>
function _uFlash() {
var f="-",n=navigator;
if (n.plugins && n.plugins.length) {
for (var ii=0;ii<n.plugins.length;ii++) {
if (n.plugins[ii].name.indexOf('Shockwave Flash')!=-1) {
f=n.plugins[ii].description.split('Shockwave Flash ')[1];
break;
}
}
} else if (window.ActiveXObject) {
for (var ii=10;ii>=2;ii--) {
try {
var fl=eval("new ActiveXObject('ShockwaveFlash.ShockwaveFlash."+ii+"');");
if (fl) { f=ii + '.0'; break; }
}
catch(e) {}
}
}
return f;
}
</extract>


Notice the try ... catch above. That would be where
the prompt would be occurring I think.
Again, I expect that a script debugger would make this
analysis much simpler. E.g. I wouldn't have had to resort
to using FiddlerTool to see the source. ; }

More importantly though it would be much more comforting
actually seeing this code used. E.g. in case there was something
else being executed which I had overlooked.

- http://www.microcenter.com/

More Macromedia Flash. (The Verisign Secured Seal at the bottom left.)
This one was hard to spot because it isn't coded conventionally.
E.g. often it is sufficient just to open View Source and do a find for .swf
This could be another example which would have been much easier
to identify using a script debugger. E.g. the HTML which renders the
Flash image is enclosed by <script> tags, so I would assume that
a script debugger might be invoked when it is rendered.


BTW here's a link to a blog page which discusses script debugging
in a bit more detail (courtesy Dave Massy [MSFT])

http://blogs.msdn.com/ie/archive/2004/10/26/247912.aspx

There are quite a few more but I thought that was a good start. I am not
familiar with any of the tools that you mentioned and they will each have to
be evaluated for the envioronment in which I work before I can install them
I have more control over my home system but still have to be careful of doing
things that could impact the other family members. Would you be able to
provide links to the sites that provide these tools so that I can start
gathering information on them? If not, I'll Google them and see what I come
up with.

Did I mention SysInternals? Oops. No I didn't. That's the site name
where you would get FileMon and RegMon. Actually it turns out I didn't
have to use them with these examples but they are both really useful tools
for many bits of analysis.

FiddlerTool has its own site and an affiliation with Microsoft
since it was written by Eric Lawrence, a Microsoft employee.

I am also unfamiliar with IMO and FWIW. Would you mind elaborating
on those a bit or pointing me to a site where I can get more familiar with
them?

New to newsgroups? ; ) Search keyword would be acronyms

http://www.freewarehof.org/acronyms.html

(Google web search for
IMO FWIW inurl:acronyms
)

Thanks again for the help.

Happy to help <w>

Robert