It is ActiveX. When you install Flash, it registers itself as an ActiveX object. If you run through your registry, you would probably be shocked to see all the

It is ActiveX. When you install Flash, it registers itself as an ActiveX object. If you run through your registry, you would probably be shocked to see all the different libraries that have been registered. To Microsoft's credit, running embedded ActiveX objects in Office is switched off by default. In large enterprise networks this can be set as part of a group policy. EMC must have switched it on. There is no granularity to it where you can say 'enable activex for video files but not for flash', so it is all or nothing. What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet (a great feature which is rarely used). The reason why they attacked with an ActiveX exploit in an office document instead of a web page is because the office documents allow you to embed the entire object so that it is loaded locally - but newer Windows will still know that the original source is from the web, so it will treat it as such. EMC must have had liberal group policies. But you see the situation often - sales guys receive powerpoint presentations with embedded objects, or are creating them, and need it enabled. You can review the various objects you have registered in windows by going to HKEY_CLASSES_ROOT\CLSID in your registry, or using a tool such as: http://www.nirsoft.net/utils/axhelper.html http://www.nirsoft.net/utils/axhelper.html To change your Office security settings, see this msft article: http://office.microsoft.com/en-us/word-help/enable-or-disable-activex-controls-in-office-documents-HA010031067.aspx http://office.microsoft.com/en-us/word-help/enable-or-disabl... Edit: just to add, OLE is just the old ActiveX. OLE on COM was very difficult to implement - so Microsoft stripped it down, simplified it and called the new set of interfaces ActiveX.