Windows 7 ActiveX will load, but not run in 32-bit version. However, works fine in 64-bit version of IE 8.

[DanDan]

Javascript will not run in IE 8 32-bit under Windows 7 post malware. Will run in IE 8 64-bit version.

Previous description:

In our office we have two Windows 7 machines showing the same experience below that has been detected due to the network admission control agent not running (the NAC agent runs using the IE engine):

When IE 8 32-bit is run and a page with an ActiveX control is loaded the prompt to run/install it is displayed.
ActiveX control is able to install fine and then the page will sit.
Testing ActiveX at Link Removed I am able to install the ActiveX, but result in just the yellow box with nothing inside of.

When IE 8 64-bit is run everything works fine, pending that it is a 64-bit ActiveX control.

I have completed a reset of IE as well as removing it through Programs and Features and re-adding it. Both computers have been scanned for malware and had returns that were able to be removed as well as the discovery of suspicious folder located at C:/programdata/ that was just random letters. In both computers, the letters were different for the folder name, but they contained the same number of files and same type of files inside (application files along with activex components). These also did not display until hidden and system files/folders were displayed.

Any suggestions would be appreciated as this prevents our users from launching the NAC agent to be able to log onto our network. Also, the suspicious files have been submitted to our security software vendor, but we are waiting to hear back.

EDIT: Original problem seemed that is was an ActiveX problem, but now it seems that the issue is actually the running of Javascript in IE8 32-bit. It has been reset and remove/reinstalled, but it cannot be repaired.

Have attempted to register the jscript.dll as well, but no luck. Can install the IE 9 beta and javascript works fine in both the 64-bit and 32-bit versions. However, IE 8 repair is required.

 

[DanDan]

Also, the suspicious files had a shortcut to the main application with the title of Internet Antivirus 2011 along with two firewall rules that had been added for the application. I feel this machine has become corrupted from it.

 

[Elmer]

I think you are right!

See Link Removed

 

[DanDan]

While some pieces are left within the system, such as shortcuts, the majority of it seems to have been cleaned up from all the scans that had previously been run when the issue was first seen. At this time, I can actively use the system without issue. For example, there are no popups, redirects in browsers, or malicious processes running.

However, the article mentioned above did make me think about the registry keys for specific settings in IE. Does anyone know of the specific keys that would allow/disallow ActiveX related scripting? While I have reset IE and removed and then reinstalled it as well, I wonder if the keys had been corrupted.

 

[DanDan]

Seems like it is scripting in general because Javascript also does not run. I really feel it has to be settings that are corrupted.

Out of curiosity I tried the IE 9 beta and that was able to run scripting fine.

 

[DanDan]

After thinking about it more and more I finally resolved to replacing the jscript.dll in the system32 folder. Once I did this and then re-registered it I was able to get javascript running again successfully.

Just as a note, since this is a system file you will have to take ownership and rename the file to get the replacement in there.