Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III

To: Kurt Seifried <bt@xxxxxxxxxxxx>
Subject: Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
From: Mike Healan <mike@xxxxxxxxxxxxxxx>
Date: Fri, 07 Nov 2003 18:14:24 -0500
Cc: bugtraq@xxxxxxxxxxxxxxxxx, NTBugtraq@xxxxxxxxxxxxxxxxxxxxxx
In-reply-to: <00cb01c3a577$83115bb0$1400000a@bigdog>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <200311051751.hA5HpYH0014051@xxxxxxxxxxxxxxxxxxxxxxx> <00ad01c3a444$bcedac50$1400000a@bigdog> <709221867.1068207734@[10.10.10.19]> <00cb01c3a577$83115bb0$1400000a@bigdog>
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030901 Thunderbird/0.2

Kurt Seifried wrote:

> If anyone knows a tool for finding out the CLSID of an ActiveX object I
> would love to know it.

Sorry if this isn't what you're asking. I'm not sure I understood whatyou meant.

HijackThis will enumerate the CLSID associated with any activex controlfound in the Downloaded Program Files folder

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Example:

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -http://www.pcpitstop.com/pcpitstop/PCPitStop.CABO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -http://a840.g.akamai.net/7/840/537/2003031901/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} (AV Class) -http://www.pcpitstop.com/antivirus/PCPAV.CABO16 - DPF: {79B96C72-C0D0-4DC8-BC7E-9F314A918228} -http://imgfarm.com/images/nocache/myspeedbar/myinitialsetup1.0.0.3.cabO16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} -http://toolbar.google.com/data/GoogleActivate.cabO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37875.0377662037O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java RuntimeEnvironment 1.4.1_01) -O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java RuntimeEnvironment 1.4.1_02) -O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave FlashObject) -http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {F798683C-FE05-436C-B0FF-35B9122E9787} -http://www.m-w.com/tools/toolbar/cabs/m-w.cabO16 - DPF: {F8F88D0D-E455-11D6-B547-00400555C7FB} (DiskHealth2 Class) -http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB




--
Mike Healan
http://www.spywareinfo.com

References:
- POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
  - From: http-equiv@xxxxxxxxxx
- Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
  - From: Kurt Seifried
- Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
  - From: Art Manion
- Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
  - From: Kurt Seifried

Prev by Date: Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
Next by Date: rpc remote return-into-libc exploit
Previous by thread: Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
Next by thread: Re: POS#1 Self-Executing HTML: Internet Explorer 5.5 and 6.0 Part III
Index(es):
- Date
- Thread