Forum thread requests to run ietag.dll?

[RavensFan]

When I went to the following thread,  http://forums.ni.com/ni/board/message?board.id=170&thread.id=390634,  I had a popup at the top of my IE7 screen saying

"The website wants to run the following addon: 'ietag.dll' from Microsoft Corporation.  If you trust the website and the add-on and want to allow it to run, click here ...."

I would usually trust the website, but trusting the add-on is another question.  Googling says it is somehow related to Office 2003.

Why would this page request to run a dll related to Office 2003?

[smercurio_fc]

It appears that the message from STTLLER (Joseph) has an embedded object in it. Given the messages that this user has posted I smell something fishy, and I think it should be looked into.

[altenbach]

You can "reply...quoute...edit as html" on that post and you'll see the following:

---

<blockquote><hr />STTLLER wrote: <br /><object classid="clsid:38481807-CA0E-42D2-BF39-B33AF135CC4D" id="ieooui"></object><!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
 {mso-style-parent:"";
 margin:0in;
 margin-bottom:.0001pt;
 mso-pagination:widow-orphan;
 font-size:12.0pt;
 font-family:"Times New Roman";
 mso-fareast-font-family:"Times New Roman";}
p
 {mso-margin-top-alt:auto;
 margin-right:0in;
 mso-margin-bottom-alt:auto;
 margin-left:0in;
 mso-pagination:widow-orphan;
 font-size:12.0pt;
 font-family:"Times New Roman";
 mso-fareast-font-family:"Times New Roman";}
@page Section1
 {size:8.5in 11.0in;
 margin:1.0in 1.25in 1.0in 1.25in;
 mso-header-margin:.5in;
 mso-footer-margin:.5in;
 mso-paper-source:0;}
div.Section1
 {page:Section1;}
--><p class="MsoNormal">Hi friends</p><p>I am Joseph from London. I am trying to find the answer of your question so can you send some detail of the above question.</p><p>Joseph</p><p>&nbsp;</p><hr /></blockquote><p>&nbsp;</p>

---

Most likely, the user pasted from some other application. Does not look malicious to me.

Still, the lithium post editor should clean out such things and only keep basic HTML.

[RavensFan]

I had noticed that extra little box on stller's message.  And as Smercurio said, it didn't suprise me that he was the cause of it.

I just came across another thread with the same situation. http://forums.ni.com/ni/board/message?board.id=170&thread.id=389669    It also had the extra little box and an MSONormal object defined in the html code.

How have 2 different forum users managed to come across a way to break the forum?

[Laura F. · Accepted solution]

I have fixed both of the threads.  I wonder if it was caused by copying and pasting directly from Word instead of using the "Paste from Word" functionality in the editor.  I'll see if I can find out.

Thanks,

Laura
Web Support & Operations
National Instruments

[smercurio_fc]

---

altenbach wrote:

You can "reply...quoute...edit as html" on that post and you'll see the following:

Most likely, the user pasted from some other application. Does not look malicious to me.

Still, the lithium post editor should clean out such things and only keep basic HTML.

---

When I saw the actual object I also thought it did not seem malicious, but then I saw the posting pattern of the user and it just seemed a bit strange. The same (essentially) exact message posted 24 times in completely unrelated threads. While I am not paranoid by nature, I somehow I highly doubt the person is working on 24 projects at once.

That, and given the number of holes that MS software has, made me think that perhaps the forum admin(s) should look at it, and it appears Laura is on the case. 

Message Edited by smercurio_fc on 03-02-2009 09:24 AM