CastleCops® Network
--------------------
About CastleCops
Become Premium
Our Sponsors
--------------------
CastleCops
CastleCops Blog
CastleCops Deutsch
CastleCops Hashes
CastleCops Mirrors
CastleCops Wiki
PIRT Squad
--------------------
Malware Removal & Prevention
How did I get infected?
Unknown file uploads
UDRP
--------------------
R3 URL SearchHook
O2/O3 BHOs/Toolbars
O4 Startups
O9 Internet Explorer Buttons
O10 LSPs
O16 ActiveX
O18 Protocol Hijackers
O20 AppInit_DLLs
O21 ShellServiceObjectDelayLoad
O22 Shared Task Scheduler
O23 XP/NT Services
--------------------
Need help
? Click
here
to register for free!
Absolutely zero advertisements on this site
!
ActiveX Objects (Downloaded Program Files) aka O16
Currently 1652 activex entries and growing...
Last updated on 2008-06-26 13:28:20 Eastern.
CastleCops ActiveX List AKA O16 List. Gargantuan thanks to Daemon for letting us insert 1,097 of his entries on 24 Jul 2005.
KEY:
"L" - Legitimate
"O" - Open to debate
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown
ABC List:
A
-
B
-
C
-
D
-
E
-
F
-
G
-
H
-
I
-
J
-
K
-
L
-
M
-
N
-
O
-
P
-
Q
-
R
-
S
-
T
-
U
-
V
-
W
-
X
-
Y
-
Z
Select ActiveX Range
--------------------
[
0-24
]
0-24
[
25-49
]
25-49
[
50-74
]
50-74
[
75-99
]
75-99
[
100-124
]
100-124
[
125-149
]
125-149
[
150-174
]
150-174
[
175-199
]
175-199
[
200-224
]
200-224
[
225-249
]
225-249
[
250-274
]
250-274
[
275-299
]
275-299
[
300-324
]
300-324
[
325-349
]
325-349
[
350-374
]
350-374
[
375-399
]
375-399
[
400-424
]
400-424
[
425-449
]
425-449
[
450-474
]
450-474
[
475-499
]
475-499
[
500-524
]
500-524
[
525-549
]
525-549
[
550-574
]
550-574
[
575-599
]
575-599
[
600-624
]
600-624
[
625-649
]
625-649
[
650-674
]
650-674
[
675-699
]
675-699
[
700-724
]
700-724
[
725-749
]
725-749
[
750-774
]
750-774
[
775-799
]
775-799
[
800-824
]
800-824
[
825-849
]
825-849
[
850-874
]
850-874
[
875-899
]
875-899
[
900-924
]
900-924
[
925-949
]
925-949
[
950-974
]
950-974
[
975-999
]
975-999
[
1000-1024
]
1000-1024
[
1025-1049
]
1025-1049
[
1050-1074
]
1050-1074
[
1075-1099
]
1075-1099
[
1100-1124
]
1100-1124
[
1125-1149
]
1125-1149
[
1150-1174
]
1150-1174
[
1175-1199
]
1175-1199
[
1200-1224
]
1200-1224
[
1225-1249
]
1225-1249
[
1250-1274
]
1250-1274
[
1275-1299
]
1275-1299
[
1300-1324
]
1300-1324
[
1325-1349
]
1325-1349
[
1350-1374
]
1350-1374
[
1375-1399
]
1375-1399
[
1400-1424
]
1400-1424
[
1425-1449
]
1425-1449
[
1450-1474
]
1450-1474
[
1475-1499
]
1475-1499
[
1500-1524
]
1500-1524
[
1525-1549
]
1525-1549
[
1550-1574
]
1550-1574
[
1575-1599
]
1575-1599
[
1600-1624
]
1600-1624
[
1625-1649
]
1625-1649
[
1650-1674
]
1650-1674
Name
Status
CLSID
Filename
Description
U
9FEFFBDE-FE2F-4756-B4A7-90D976255F9B
Stopzilla.cab
This is not a
Stopzilla
file, this is a
playminigolf
game cab. For more information
Click_Here
X
0FFFFFFF-0FFF-0FFF-0FFF-0FFFFFFFFFFF
hdesk_of...DeskSetup_A.exe
Listed as TrojanDropper.Small.LG by SpywareBlaster.
X
0FFFFFFF-0FFF-0FFF-0FFF-0FFFFFFFFFFF
inst.exe
Listed as TrojanDropper.Small.LG by SpywareBlaster.
O
10954C80-4F0F-11D3-B17C-00C0DFE39736
fav.exe
Not malicious but adds crack sites to IE search bar and Tools.
L
4C57C98A-E582-46E4-8FD8-5EBDC94CEA39
MmViewer.cab
Related to
Mind_Manager
from Mindjet - Easy way to organize ideas and information.
X
97B79133-88F0-45F0-8D57-0F2EF27D9C66
rdgGB2404.exe
Spam Assassin Malware.
X
539DA0E0-74A7-11D9-9669-0800200C9A66
mmviewer_ic13.cab
Listed by SpywareBlaster as Trojan.Downloader.Miewer.A.
X
FDCC1518-6A63-11D9-AAC8-91EC5E497716
mmviewer_emg11.cab
Listed by SpywareBlaster as Trojan.Downloader.Miewer.A.
X
10000000-1000-0000-0000-000000000000
Q678341.exe
Added by the Hijacker.Small as reported by ewido suite.
X
B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A
WinAntiVirusPro2006FreeInstall.cab
Related to the rogue program WinAntiVirus Pro2006.
X
09F1ADAC-76D8-4D0F-99A5-5C907DADB988
SystemDoctor2006FreeInstall.cab
Related to System Doctor 2006 hijacker.
L
0FC6BF2B-E16A-11CF-AB2E-0080AD08A326
getcab2.dll
The site doesnt exist now but they made Crescendo!,
http://www.armadilloweb.com/Crescendo/Crescendo.shtml
which enabled anyone with an MPC sound card equipped Windows PC to listen to background music as they surf.
X
00000000-0000-0000-0000-100000000003
e83d919e87...2a33d1d2_35.exe
Added by the
Trojan-Downloader.Win32.Small.bwy
X
886DDE35-E955-11D0-A707-000000881958
webplugin.cab
Kaspersky Anti-Virus Found Trojan-Downloader.Win32.OneClickNetSearch.f
X
4AD73894-A895-4FC2-B233-299867E08753
adwerkz.cab
AntiVir Found Adware-Spyware/Dekwizz adware
L
CCC46940-DED0-476C-A27E-115B10DAE0B4
WSAS.cab
Norton_Confidence_Online
X
04F414E9-E352-4BC3-963D-7BFE5A5F31A9
egaccess4_1064_XP.cab
EGDAccess dialer.
X
00000000-0000-0000-0000-000330050660
aboxinst_int20.exe
Reported as Win32/TrojanDownloader.VB.FI by NOD32.
X
2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6
installdrviecleanerstart.cab
Innovative Marketing Group Adware!
X
2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6
Installdrivecleanerstart.cab
Rogue
program
X
B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A
WinAntiVirusPro2006freeInstall_se.cab
Related to Win32/Adware.WinFixer
X
00000000-6666-0704-0B53-2C8830E9FAEC
axload.cab
Site
key.one2bill.de
blocked by this host file.
L
321FB770-1FBE-4BFE-BDC1-6F622D4FA499
ALLTEL...aller_2-0-0.cab
Related to
Alltel
communications.
L
74C861A1-D548-4916-BC8A-FDE92EDFF62C
install.cab
Related to
Walmart
media player.
X
B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A
ErrorSafeNewReleaseInstall.cab
Added by
ErrorSafe
ROGUE program
Ranges
[
0
] [
25
] [
50
] [
75
] [
100
] [
125
] [
150
] [
175
] [
200
] [
225
] [
250
] [
275
] [
300
] [
325
] [
350
] [
375
] [
400
] [
425
] [
450
] [
475
] [
500
] [
525
] [
550
] [
575
] [
600
] [
625
] [
650
] [
675
] [
700
] [
725
] [
750
] [
775
] [
800
] [
825
] [
850
] [
875
] [
900
] [
925
] [
950
] [
975
] [
1000
] [
1025
] [
1050
] [
1075
] [
1100
] [
1125
] [
1150
] [
1175
] [
1200
] [
1225
] [
1250
] [
1275
] [
1300
] [
1325
] [
1350
] [
1375
] [
1400
] [
1425
] [
1450
] [
1475
] [
1500
] [
1525
] [
1550
] [
1575
] [
1600
] [
1625
] [
1650
]
2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved.
Acceptable Use Policy
. Use signifies your agreement.
130ppm 0.056s (0.005s)
Making cybercriminals unhappy since 2002
*