Re: Mystery Win 7 Machine

[Dan Taube]

Title: Untitled Document

After working on two machines with this same issue we determined that _javascript_ was not running properly in Internet Explorer. Resets of IE along with the removal and re-installation of it did not resolve the problem. After a lot of security setting checking and registry investigation we discovered the issue to be with the _javascript_ DLL, jscript.dll, in the System32 folder. We had tried to re-register the DLL with no luck, but eventually a replacement of this file was able to solve the problem with _javascript_ running in IE and then the NAC agent was able to display properly. Both system had been infected with malware called 'Internet Antivirus 2011' and had to be cleaned up through several scanners and some manual steps before we got to the actual fix. Some notes: - Verified the issues with _javascript_ through tests and noticed it would not run despite the settings being to the default zone configuration. - One system was 64-bit IE and the scripting worked in the 64-bit version of Internet Explorer, but not the 32-bit version. With this, there are also two different jscript.dll files located under either C:\Windows\System32\ and C:\Windows\SysWOW64\ and the one in the SysWOW64 folder had to be replaced for IE 32-bit. - To replace the standing jscript.dll file you will need to work with ownership and security permissions. On 1/14/2011 4:37 PM, Dan Taube wrote: We utilize Malwarebytes, SpyBot, and our University anti-virus for finding malicious files and are successful in detection and removal from all, but the problem still exists. In the case of the parasite zone in the registry, the malware had been removed successfully, but the registry key was left behind and caused the experience. Dan Taube University Computer Help Desk Illinois State University On 1/14/2011 2:27 PM, David Pifer wrote: Our team tried Malware-bytes against the machine and it found a Trojan that it removed. Now the PC works just fine.     David Pifer OIT Networking 812.237.2923   From: Cisco Clean Access Users and Administrators [mailto:CLEANACCESS@LISTSERV.MUOHIO.EDU] On Behalf Of Dan Taube Sent: Friday, January 14, 2011 2:46 PM To: CLEANACCESS@LISTSERV.MUOHIO.EDU Subject: Re: Mystery Win 7 Machine   We have seen this also when there is a proxy server that was set in IE (usually malware infected machines), when IE is in work offline mode, or the DNS problems. Also, we recently detected issues related to malware that causes a parasite zone to be installed in the registry referred to in this forum post from me: http://windows7forums.com/windows-7-support/52363-one-more-activex-controls-could-not-displayed-because-either-2.html#post190527 However, a few days ago we started having computers that have this same issue without any of the above noted causes. I am currently working with TAC on the case and getting a few more systems into my office so I can track down a common reason for the problem. Dan Taube University Computer Help Desk Illinois State University On 1/14/2011 1:11 PM, Jeremy Shoemaker wrote: Generally, when we see this, the users have a manually set (or spyware corrupted) DNS entry. They may have some other network issue as well. The first test I do is ensure that they can ping your CAS.   Thanks, Jeremy L. Shoemaker Systems Administrator Dakota Wesleyan University 605-995-2147 jesho...@dwu.edu Strategic - WOO - Maximizer - Achiever - Learner   From: Cisco Clean Access Users and Administrators [mailto:CLEANACCESS@LISTSERV.MUOHIO.EDU] On Behalf Of David Pifer Sent: Friday, January 14, 2011 1:01 PM To: CLEANACCESS@LISTSERV.MUOHIO.EDU Subject: Mystery Win 7 Machine   WE have lots of Windows 7 machines around but we came upon one that is stumping us. If we install the CCA client on the machine it doesn’t pop up to login and if we run the web browser it prompts us to install the client again. When right click on the CCA Task Manager icon you can select any option but nothing pops up. Any ideas?     David L. Pifer - N9YNF - CCNA TIS Network Engineering Services Indiana State University, Office of Information Technology 210 N. 7th St., Rankin Hall R044, Terre Haute, IN 47809 812.237.2923 office  812.237.4361 fax   Indiana State University and the Office of Information Technology would like for you to know: *** This email, and any attachments, thereto, is intended only for use by the addressee(s) named herein and may contain privileged and/or confidential information.  If you are not the intended recipient of this email, you are hereby notified that any dissemination, distribution or copying of this  email, and any attachments thereto, is strictly prohibited. *** A full disclosure of ISU and OIT Official Computing Policies and Procedures is available at http://www.indstate.edu/oit/official_docs/compolicy.html ***   -- Dan Taube Call Center Supervisor & Associate IT Support University Computer Help Desk Illinois State University 309.438.8985 [direct] 309.438.4357 [support] www.helpdesk.ilstu.edu alerts.illinoisstate.edu