"Active X" - Good or Bad??

Chip Fossa · Post by **Chip Fossa** » 24 Sep 2006 12:21 pm

Just what is "Active X", anyway?

What I gather, is that it can cause a lot of problems, is a definite part of IE, and probably should be avoided at all costs.

I tried to hear that 4-year old drummer in the MUSIC section, but the site said I didn't have ActiveX and would have to download it to hear the kid; which, of course, I didn't do.

Figured I better ask and find out just what the deal is with ActiveX.

Thanks all.

Wiz Feinberg · Post by **Wiz Feinberg** » 24 Sep 2006 12:47 pm

ActiveX Controls can be used for good or evil. Unfortunately, they are frequently used by evil people to hijack computers and/or to download harmful programs without your knowledge.

Microsoft uses ActiveX to scan your computer to see what updates you need. Crucial uses ActiveX to see what type of RAM you use, anti-virus scanners use ActiveX controls to scan for viruses.

You must choose your own level of risk that you are willing to assume. If you browse with Firefox you won't have to deal with ActiveX threats, as such.

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices

Chip Fossa · Post by **Chip Fossa** » 24 Sep 2006 1:40 pm

Thanks Wiz,

Yes, I do use Firefox; so would you say it's OK to download that ActiveX on that little drummer's page? I suppose I could go and run some or all of my antispy/mal programs after I installed it. I mean, I'm not that savvy to figure out if I should take a chance or not.

Is there just one ActiveX? Is it upgraded ever?
Do other sites that call for AX have different versions?

b0b · Post by **b0b** » 24 Sep 2006 2:56 pm

There are a few that I consider safe. Adobe's PDF Reader, for example, and Macromedia's Flash player.

I wouldn't install an ActiveX control from any small startup company I never heard of. These days, most web developers are shying away from ActiveX because it limits their audience. ActiveX only runs in IE, and a good percentage of users have switched to Firefox.

I think that ActiveX is only useful for internal corporate applications at this point. A corporation can dictate "everyone must use IE", and they can distribute ActiveX within the organization easily. It's more trouble than it's worth for a public internet application, though.

------------------
<img align=left src="http://b0b.com/b0bxicon.gif" border="0"> Bobby Lee
-b0b- quasar@b0b.com 
System Administrator 
My Blog<div style="display:none">

Chip Fossa · Post by **Chip Fossa** » 24 Sep 2006 4:32 pm

Thanks, too, b0b.

I do have Adobe PDF Reader, and Macromedia Flashplayer.

But here we go again. How can you tell what you're downloading, FOR SURE, like that drummer boy's website?

I think by both of your responses that it's still up to me. Nothing is clear-cut here.

I'm just gonna opt on the side of caution and not bother with questionable ActiveX; even tho I don't have a clue what is questionable.

Wiz Feinberg · Post by **Wiz Feinberg** » 25 Sep 2006 8:53 am

Good ActiveX controls are usually "signed" by the company who wrote and/or distributed them. When you need to upgrade an ActiveX control to use Windows/Microsoft Updates you are presented with a certficate showing that the control is certified by Microsoft Corp. Ditto for other legitimate ActiveX controls. While there is always the possibility that a scumbag malware company will pay to obtain such a certificate, and that does occur in the case of adware, in most instances a "signed" ActiveX control is (relatively) safe for public use.

Exceptions do occur, so you should read the details about the signer carefully before allowing an ActiveX control to be installed.

You can protect your operating system itself against hijacking by operating as a Limited User, instead of Computer Administrator. See this blog entry for more info about running as a Limited User. I also wrote a webpage explaining the differences between various user account types. It is titled Windows 2000 and XP User Account Privileges Explained.

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices. My FAQs.

b0b · Post by **b0b** » 25 Sep 2006 9:34 am

I never download new ActiveX controls, signed or not, from small companies that I never heard of. There's no content that I want bad enough to put my computer at risk.

I also refuse RealAudio and its offshoots. They are nasty and intrusive.

------------------
<img align=left src="http://b0b.com/b0bxicon.gif" border="0"> Bobby Lee
-b0b- quasar@b0b.com 
System Administrator 
My Blog<div style="display:none">

Chip Fossa · Post by **Chip Fossa** » 26 Sep 2006 3:09 am

Thanks again, fellas. I appreciate it.

Wiz Feinberg · Post by **Wiz Feinberg** » 26 Sep 2006 12:29 pm

Chip;
Avoid unnecessary exposure to malware that exploits ActiveX controls by switching to Firefox for your daily browsing of the 'Net. Use IE for Windows/Microsoft Updates only.

Get Firefox Here.

There is yet another Activex Internet Explorer vulnerability that has been discovered in the wild. Watch for a new Post about it in a few minutes, brought to you by Eyes Only.

Wiz[This message was edited by Wiz Feinberg on 26 September 2006 at 01:55 PM.]

Chip Fossa · Post by **Chip Fossa** » 26 Sep 2006 1:05 pm

Wiz,

I just now created a Limited Account, and when I rebooted and clicked on it, the desktop was missing about 2/3 of my icons from Administrator account. Zone Alarm then popped up, and when I clicked on an option, it froze up. Then 'an unused desktop icon wizard' asked me if I wanted to continue, and when I clicked on it, it too froze.

I had to manually shutoff the PC. When I rebooted again, I chose 'administrator' account, but it froze up, too. This freeze-up went back and forth between both accounts, and manual shutoff, when I finally just hit ENTER and then all seemed normal.

Got nervous there, for a bit. I haven't tried going back to the Limited acct, as I'm not sure if I screwed something up or the freezing up is being caused by something else.
I hate to keep having manually to turn off the PC. Is it really that bad for the PC to do that? I was stuck. What else can you do?

I use Firefox exlusively, even for Windows and MSN updates.[This message was edited by CHIP FOSSA on 26 September 2006 at 02:06 PM.]

Wiz Feinberg · Post by **Wiz Feinberg** » 26 Sep 2006 1:42 pm

Chip;
Something else must be causing the freezeups. Log onto the Administrator level account, Start > Run and type Regedit. When the Registry Editor opens click on the following items until you get to the destination below:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Look in the right pane and scroll down through the sub-keys until you see one labeled Shell. It should have an AB icon for the labeled key. This means string value. Look at the value that appears to the right of the Shell key. If all is as it should be the value will be Explorer.exe. If there is anything else appended to that value copy and paste it here, by double-clicking on the Shell key to open it, highlight the string value, right-click and choose Copy, then paste it into your reply. If you accidently CUT or modify the value of that key click Cancel instead of OK, to avoid changing anything (yet).

Do not edit anything in the Registry unless instructed to do so. Close the Registry Editor for now until it is needed again.

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage. Get Firefox Here.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices. My FAQs.

Chip Fossa · Post by **Chip Fossa** » 26 Sep 2006 2:01 pm

Wiz,

Here's what I found in Regedit:

Shell REG_SZ Explorer.exe

That was it. No other values.

Wiz Feinberg · Post by **Wiz Feinberg** » 26 Sep 2006 7:01 pm

Chip;
Sorry it took so long to reply to you. I have been preoccupied with the VML vulnerability and the subsequent out-of-cycle release of a patch by Microsoft.

The good news is that you still seem to own your Windows Desktop (Shell = Explorer.exe).

I don't know what caused the freezeups without seeing a HJT log. Has the matter resolved itself?

Have you obtained today's critical patch from Windows Updates? If not, what are you waiting for?

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage. Get Firefox Here.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices. My FAQs.

[This message was edited by Wiz Feinberg on 26 September 2006 at 08:03 PM.]

Chip Fossa · Post by **Chip Fossa** » 26 Sep 2006 7:38 pm

Wiz,

Yes, I'm pretty much updated. I have auto-update with Windows and MS. And I still manually go to the sites just to be double-sure.

What I did was go back into User Accounts and completely deleted the newly created Limited account.

It was (I guess) still causing quirky things.

The PC is working fine as we speak.

Wiz, I have installed and purchased many of your [recommended] anti-spam and malaware programs [about 10, now]. So I'm a bit confused as to why I would really need the Limited account. I know this whole thing centers around ActiveX. But as b0b mentioned, I don't care, half the time what is there to necessitate downloading ActiveX.

I'm losing my point here, but, I now actively update and run these ANTI programs.
This should cover me, pretty much, without having to have that other account [limited],
wouldn't it?

If it didn't go bonkers on me, I would have gladly used it. But it looked like trouble right from the git-go. That's why I deleted it.

Fair-enough, I guess.

Not your fault, friend.

Chipper

Wiz Feinberg · Post by **Wiz Feinberg** » 26 Sep 2006 7:53 pm

Chip;
Might I offer a suggestion to easy your entry into LUA (Least User Authority)? Instead of creating a new account to browse the net, create a new Administrator level account for performing administrative tasks, then reduce your regular account to a Limited User. That way you will keep all your shortcuts and have authority over programs that you installed from that account. If it doesn't work out you can go back to the Admin account and elevate your other account to Admin level.

As for why you should not run as an administrator, despite having all that protection, the just patched VML vulnerability would have fully impacted you fully patched and protected computer if you happened to be fooled into visiting a website that contains the exploit code. The same goes for many other exploits in the wild, in that they are designed to get past defenses and install themselves with administrator privileges as services. If you don't run as admin this type of threat will not impact you as much, or at all, depending on how it was written. It is a known fact that almost all malware requires administrator privileges to fully embed itself into your OS. I have instructions about this on my website, with links in my signature (to FAQs).

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage. Get Firefox Here.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices. My FAQs.

Chip Fossa · Post by **Chip Fossa** » 30 Sep 2006 1:42 pm

Hiya Wiz,

OK...I just made a second Administrative account (Foghorn2); and changed Foghorn to the Limited account. When the PC rebooted, both
Foghorn & Foghorn2 showed up, and when I clicked on Foghorn, here I am. No problems so far.

So what is basically the best way to use both these accounts? I don't know what you mean by "administrative tasks". I'm unclear on this. Give some examples if you would.

I guess when I go on-line I should use the Limited Account? Can I switch from Limited to Administrative accounts without shutting down the PC and rebooting?

Bear with me hear, please. My rookiness is popping thru. Thanks Wiz.

Wiz Feinberg · Post by **Wiz Feinberg** » 30 Sep 2006 2:17 pm

I guess when I go on-line I should use the Limited Account? Can I switch from Limited to Administrative accounts without shutting down the PC and rebooting?

Chip;
Congratulations! You have just moved up to join the big dogs! Yes, you can Switch between Accounts by right-clicking on your Recycle Bin, highlighting "Switch User" and left clicking on that option. You will instantly go to your Welcome screen where you can choose the account to log into, do your administrator stuff, log off that account and log back into your Limited privileges account.

Once you get the hang of this you will no longer be troubled with spyware, keyloggers, most viruses, trojans, backdoors, browser exploits or cosmic radiation!

Let us know how you fair as a Limited User. Maybe I can convince other SGF members to do the same.

You can learn about the differences between different types of user accounts and the limitations imposed on a Limited User here.

------------------
Bob "Wiz" Feinberg
Moderator of the SGF Computers Forum
Visit my Wiztunes Steel Guitar website at: http://www.wiztunes.com/
or my computer troubleshooting website: Wizcrafts Computer Services,
or my Webmaster Services webpage. Get Firefox Here.
Learn about current computer virus and security threats here.
Read Wiz's Blog for security news and update notices. My FAQs.[This message was edited by Wiz Feinberg on 30 September 2006 at 03:20 PM.]

Chip Fossa · Post by **Chip Fossa** » 30 Sep 2006 3:11 pm

Thanks again Wiz, not only for my guidance that you have generously offered, but to all Forum members.

I would never, ever, know or begin to look at where to go to get this invaluable and very critical information.

I certainly will be reading your exposes, and keeping you and the brothers/sisters informed to what I see happening.

Much thanks Wiz for all you are doing here in "COMPUTERS".

BRAVO!

WHOOPS...one more thing, Wiz. What are you supposed to do with and within the Administrative Account?[This message was edited by CHIP FOSSA on 30 September 2006 at 04:25 PM.][This message was edited by CHIP FOSSA on 30 September 2006 at 04:27 PM.]

Chip Fossa · Post by **Chip Fossa** » 30 Sep 2006 4:58 pm

Nope.......same problems. This time I clicked on Foghorn2 and got the same freeze-ups.

DESKTOP CLEANUP WIZARD led me into the cauldron.

Sorry Wiz........this is just a failure.