NOD32 breaks ActiveX?

I've been trying to get various things to work over the last few days that have involved ActiveX - winks on MSN require Flash which is installed as an ActiveX plugin, MSN Games require plugins, Egg Money Manager, ths list goes on.

It came to my attention that ActiveX didn't work. It just pops up the box, you click install, and then nothing happened! I did some googling, and found a few other people with the same problem, and thought it might be SP2 related - and it may be....

I formatted, reinstalled a slipstreamed SP2 and ActiveX worked. I then decided it must be some software, so I installed pieces one by one and found it was NOD32 causing the problem. I did more googling and found a few others with the problem. One guy cured it by going back to SP1. But a friend of mine runs NOD32 with SP2 with no problems... so I'm confused - I have emailed Eset though.

Could anyone with NOD32/SP2 try this in IE:

http://www.pcpitstop.com/testax.asp

And any suggestions/solutions welcome!

 

It works in mine. I had to click to install.

Neil

 

I'm not entirely sure what you're saying - does it work or not? I don't think posting the content of the page really helped!

I get the dialog asking me if i want to install, i click install and nothing happens. A red x appears to signify it didn't work. If anyone has any idea as to why this happens, that'd be great.

 

Some people prefer to have ActiveX disabled because of the risk it presents in terms of access to your computer or viruses etc. I'm not too sure why your's isn't working though.

Neil

 

Hi csmager:

Did you follow the instructions here?

http://www.pcpitstop.com/faq/security.asp

NOD32 by itself does not block ActiveX controls unless they are malicious (or possibly malicious). Since you are not receiving an IMON or AMON alert, this presumably is caused by the security configuration of IE.

Drop us a note if this helps!

 

I've followed every piece of advice I can find for configuring IE and the like - nothing helps.

All I know is a fresh install of XP SP2 works completely fine.

Installing NOD32 breaks ActiveX.

This happens on 3 out of 3 of my pcs. And it does appear I'm not alone.

 

With this unusual issue can you please send an email to support@nod32.com and place a link to this thread. If you do not hear from Eset within 3 days (allows for weekends), please advise us here...

We would appreciate if you could keep us in the loop with your progress, as we all learn this way…

Cheers

 

I have also been suffering the same problem as csmager, and have been corresponding with him regarding it on another forum.

I first noticed the problem a couple of weeks ago, having bought an IP Camera which needs to install an ActiveX control to enable configuration through IE. I couldn't get the control to install. I then found that I couldn't get any new ActiveX controls to install, although those that were already in my Downloaded Program Files folder still worked normally (including Windows Update). I assume that the problem must have existed since updating to XP SP2, though I hadn't noticed it before, as I hadn't needed or tried to install any other ActiveX controls.

After trying many things, including re-registering crypto dlls and reinstalling security certificates, I decided to format and re-install XP Pro. As soon as I was up and running (on SP1) I connected to my IP Camera and installed the ActiveX control with no problem. I found that other ActiveX controls would download and install, so thought the problem was solved.

Then I let Windows Update bring me back to SP2 and found that I was prevented from installing any ActiveX controls again, although those already installed worked fine, so I assumed that the problem was being caused by SP2 somehow.

The symptoms are that when I go to a page that wants to install an ActiveX control, I get the IE Information Bar notification. I click on that to select Install, and get the box giving me the option to Install or Cancel - all perfectly normal SP2 behaviour so far. As soon as I click on Install however, the box closes and I just get a red cross on the page where the graphic placeholder icon was displayed, and nothing gets downloaded.

I haven't actually found anything whilst searching Microsoft KB that completely fits my problem, but did find out that if an ActiveX download fails, a log file is created in the Temporary Internet files folder, called
"?CodeDownloadErrorLog!name={<CLSID of failed component>}"

A Code Download Error Log Viewer can be obtained from Microsoft at http://download.microsoft.com/download/6/8/3/683DB9FE-8D61-4A3C-B7B8-3169FF70AE9F/cdllogvw.exe which allows viewing of the error logs created when an activex install fails. I found that every failure had the same error 80004005, as per the below log entry:

--------------------------------------------------------------------------
Code Download Error: (hr = 80004005) Unspecified error

Operation failed. Detailed Information:
CodeBase: http://www.pcpitstop.com/mhLbl.cab
CLSID: {9732FB42-C321-11D1-836F-00A0C993F125}
Extension:
Type:

LOG: Reporting Code Download Completion: (hr:80004005 (FAILED), CLASSID: 9732fb42..., szCODEhttp://www.pcpitstop.com/mhLbl.cab), MainTypenull), MainExtnull))
--- Detailed Error Log Follows ---
LOG: Download OnStopBinding called (hrStatus = 0 / hrResponseHdr = 0).
LOG: URL Download Complete: hrStatus:0, hrOSB:80004005, hrResponseHdr:0, URLhttp://www.pcpitstop.com/mhLbl.cab)
LOG: Reporting Code Download Completion: (hr:80004005 (FAILED), CLASSID: 9732fb42..., szCODEhttp://www.pcpitstop.com/mhLbl.cab), MainTypenull), MainExtnull))
--------------------------------------------------------------------------

According to Microsoft, this error code indicates that the data cannot be accessed. The error can be paraphrased as "I could not access your data for some reason." The log above relates to the date/time test control at www.pcpitstop.com, but the erro message and code is identical for all installation attempts from varying sources.

Having backed out to SP1 again, the problem was resolved, but on returning to SP2, downloading of activex controls again stops working. The problem is entirely reproducible on my machine.

I know that csmager has the same problem (and the same error code) on at least three of four machines. The similarities are that we are both running XP Pro SP2, and both running our machines on small private LANs behind routers running NAT. We have both experimented with bypassing the routers and can rule them out as a cause of the problem.

The other similarity between us is that we are both running NOD. I have experimented with disabling IMON, but found that had no effect on the problem. csmager has now informed me however that he has found that completely removing NOD from his machine allows ActiveX controls to download and install, and that re-installing NOD reintroduces the problem.

I haven't yet had chance to try this on my machine, but I have no reason to doubt what he is saying. Once I have tried it I will of course report back here.

That is why csmager is asking any other NOD users running SP2 (preferably XP Pro) to try the activex test download at http://www.pcpitstop.com/testax.asp to see if the problem is reproducible. The control is quite safe and simply inserts the current date and time in the relevant web page (if it works on your machine!).

Once you have completed the test, the control can easily be removed if desired by opening the Tools/Internet Options menu in IE, selecting General/Temporary Internet Files/Settings/View Objects, right clicking on the entry for "mhLabel Class" and selecting Remove.

I would reiterate that unless you have consciously attempted to download an ActiveX control since installing SP2, you would not be aware even if you do have the problem.

I just have a niggle in the back of my mind. I know that NOD shouldn't interfere with ActiveX controls unless they are malicious and detected in its database, but it will be checking them as they download. If NOD's intervention is causing the data to be delayed or not presented as the OS expects, could that cause IE to log a download error?

 

Works fine here, XP SP2, NOD set to max settings. Perhaps it is your browser or firewall settings.

 

Add me to the "no problems found here" group. Fresh SP2 install, already had NOD installed with tight settings before I ran across this thread. Had to run IE (blech) to test it, since Opera doesn't do ActiveX, but the control installed just fine and ran properly.

 

It's definitely not NOD32 causing this - check out the screenshots (there'll be three or four in separate posts due to the lovely fact that you can't post more than one attachment per post here). Pete

 

Second one.

 

Number 3

 

Number 4

 

Number 5 - This is the section of Tools/Internet Options "Security" tab/"Internet" Zone/"Custom Level" you need to look at (if indeed, you're using a "Custom"ized level - if you're at the default, that's probably what's killing you right there). Sorry that took so long - I'm running behind Tor/Privoxy/SocksCap and things are slower than all get-out right now.

Would some of you people that can do so please consider running a Tor server? Pete

 

Sorry if I'm being somewhat dense here, but how on earth do those 4 posts prove that "It's definitely not NOD32 causing this"?

That seems completely unfounded to me. I'm not a complete dunce, I have checked and triple checked my security settings, and even when there isn't a single piece of software on 3 different PCs, except NOD32, ActiveX controls won't install. Uninstalling NOD32 causes ActiveX installs to work again.

 

Did you send an email to support@nod32.com regarding this issue?

Cheers

 

Right, this is what I have done this morning:

1) Completely wiped, reformatted and installed XP Pro SP1 on my C: drive.

ActiveX downloads fully working.

2) Installed SP2 from SP2 Network Update KB835935

ActiveX downloads fully working

3) Installed the following updates one at a time, rebooting after each update and testing:

KB886185 Critical Update for Windows XP
KB834707 Cumulative Security Update for IE XP SP2
KB887797 Cumulative Update for OE Windows XP

System now fully updated according to Windows Update.

ActiveX downloads still fully working.

Installed NOD32 2.12.3 - Amon starting automatically, HTTP checking enabled and IMON registered to system, DMON disabled (I use OpenOffice).

Selected option to reboot later at the end of the install.

Tested ActiveX - broken. Error 80004005, exactly as before.

Rebooted. Tested ActiveX - broken. Error 80004005, exactly as before.

Uninstalled NOD. Rebooted. ActiveX downloads fully working.

Re-installed NOD. Rebooted. ActiveX broken.

Sure looks like a NOD conflict to me Why it only seems to affect certain systems is a mystery.

I will also email Eset with a link to this thread. I wanted to do my own tests as above before sending a support request though, as up to now I wasn't completely certain.

Edit: Should also add that I had SP2 firewall totally disabled during these tests, and all IE settings at default.

==========================================================
NOD32 Antivirus System information
Virus signature database version: 1.962 (20041231)
Dated: 31 December 2004
Virus signature database build: 5117

Information on other scanner support parts
Advanced heuristics module version: 1.011 (20041126)
Advanced heuristics module build: 1067
Internet filter version: 1.002 (20040708 )
Internet filter build: 1013
Archive support module version: 1.025 (20041221)
Archive support module build version: 1106

Information on installed components
NOD32 For Windows NT/2000/XP/2003 - Base
Version: 2.12.3
NOD32 For Windows NT/2000/XP/2003 - Internet support
Version: 2.12.3
NOD32 for Windows NT/2000/XP/2003 - Standard component
Version: 2.12.3

Operating system information
Platform: Windows XP
Version: 5.1.2600 Service Pack 2
Version of common control components: 5.82.2900
RAM: 512 MB
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz (2672 MHz)

 

Thanks Phil, appreciated, and good to see the thoroughness of your testing...

Cheers

 

Couple more tests I've tried in the meantime:

IMON running, HTTP checking disabled, ActiveX still broken.

IMON disabled, rebooted to remove NOD from the LSP chain, ActiveX still broken (had tried this last week - the first time I wiped and reformatted my disk - but wanted to make sure.

So it seems to me to be something to do with the way NOD installs itself on my system, and not a conflict with the http scanner or Internet settings.

Phil - currently in the process of reloading all my software for the second time in a week!

 

Glad you found the same as me! Hopefully Eset will reply to the few emails they have.... and I really hope they can reproduce the problem!

 

Guess I should have clarified - it's definitely not NOD32 causing what you're seeing here. The screenshots plainly show that it's IE that's throwing up the ActiveX warning (first screenshot). That's IE doing the warning. When I clicked on that warning, it told me again that it was a Windows Explorer security warning (second screen shot). When I clicked to "Install", I got a warning from SBS&D's "Resident" protection about it (third screenshot), which I "Allow change"d on. The ActiveX control successfully installed, as shown by the fourth screenshot.

(Sigh) I never implied that you were. If you somehow got that impression, you're mistaken (but I'll apologize anyway).

The only reason I took the time to do all that was because I, too, am running Win XP Pro and NOD32 (same specs as yours re: NOD) - and I'm not having the problem you're having. I verified that by going through all the steps shown in the screenshots.

Since your problem evidently stems from something not seen here on my machine, I'll happily bow out and let you get it resolved.

Good luck. Pete

 

I'm still not entirely convinced I know what you're getting at here, but my summation of it so far is, instead of your four posts, you could've written "It works fine for me", as it indeed seems to for some.

I think everyone knows what *should* happen, this being evident in the fact that some of us realise it isn't functioning correctly with NOD32 being sited as the cause of this.

 

Hello csmager,

Well I have to agree with some of the other posters here, in that I haven't found any issues or problems regarding installing ActiveX type programmes and I'm also running XP SP2.

However, the problem might be caused by DMON which scans ActiveX elements. I know Phil_S said he disabled DMON but I don't think it's truly disabled when you do this. Even re-installing and not having DMON included as a default scanning module (can be done in Advanced and Expert modes of installation) may not totally stop DMON from being present.

I suggest you download this file from here: http:\\eset.zftp.com/ntstden.nup and save it somewhere safe.

Next, uninstall NOD32 and reboot. Now locate the file you've downloaded and copy it to the Eset Install Directory. You are in fact replacing a file (ntstden.nup) so you may want to backup the original. Personally, I wouldn't bother because if you wanted to revert back to your existing setup, you could simply download a fresh installer, but that's up to you.

Now run the setup.exe from the same directory, to re-install NOD32. Now, if all goes according to plan, you will have no DMON installed whatsoever.

How do ActiveX apps behave now?

Bandicoot (Eset).