goto a screen saver site and download and run one? (I think this would be covered by activex but not sure). If so, not enuf. End users do this. Browse to sites like clips4u.biz which install spyware. If you don't get any may be OK.
We had a computer that had activex and scripts disabled. There was a virus that propagated from PC to PC a few months ago via tcp and it hit this computer. Anti-virus did detect it after installed tho and popped up message.
My boss was trying to blame it on email attachment opened or web browsing and I told him NO, it was totally locked down (a critical production workstation) for this very reason, for last two years. This encourages them to use other workstations as activex disabled.