|
wscript.exe (5.6.0.6626)
Contained in software |
|---|
| Name: | Windows XP Home Edition, Deutsch |
|---|
| License: | commercial |
|---|
| Information link: | http://www.microsoft.com/windowsxp/ |
|---|
File details |
|---|
| Filepath: | C:\WINDOWS\system32 \ wscript.exe |
|---|
| Filedate: | 2002-08-29 14:00:00 |
|---|
| Version: | 5.6.0.6626 |
|---|
| Filesize: | 118.834 bytes |
|---|
Checksum and file hashes |
|---|
| CRC32: | CEC250F2 |
|---|
| MD5: | BF75 2BED 043E 2DDE 3009 FC10 EAC4 400A |
|---|
| SHA1: | 1F6D 251E D139 6905 1548 5962 8C71 CC66 F955 89B5 |
|---|
Version resource information |
|---|
| CompanyName: | Microsoft Corporation |
|---|
| FileDescription: | Microsoft (r) Windows Based Script Host |
|---|
| FileOS: | 32-bit Windows |
|---|
| FileType: | Application |
|---|
| FileVersion: | 5.6.0.6626 |
|---|
| InternalName: | wscript.exe |
|---|
| LegalCopyright: | Copyright © Microsoft Corp. 2001 |
|---|
| OriginalFilename: | wscript.exe |
|---|
| ProductName: | Microsoft (r) Windows Script Host |
|---|
| ProductVersion: | 5.6.0.6626 |
|---|
wscript.exe was found in the following malware reports:
|
|
|---|
VBS.CandyLove |
|---|
Technical details
...3r1k4 wscript.exe %windows%ilove.vbs to the registry key...
...It will repeat this over and over again until you kill the process of Wscript.exe. (This is the Windows script engine that translates the script into executable code...
...To stop this virus once it is in the forever loop, you must stop the process of Wscript.exe). ...
Removal instructions
...If it is running, stop the Wscript.exe process. (Or restart the computer in Safe mode.)...
...3r1k4 wscript.exe %windows%ilove.vbs from the registry key...
...the following instructions. To stop the Wscript.exe process: Press Ctrl+Alt+Delete one...
...Click the Process tab. Locate the Wscript.exe item, select it, and then click End Task....
...3r1k4 wscript.exe %windows%ilove.vbs Navigate to the following...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.candylove.html |
|---|
VBS.Injust@mm |
|---|
Removal instructions
...to %windir%WScript.exe,2 If use Windows 95, 98, or...
...to %windir%WScript.exe "%1" %* If use Windows NT, 2000,or...
...to %SystemRoot%System32WScript.exe,2 If use Windows NT, 2000, or...
...to %SystemRoot%System32WScript.exe "%1" %* Write-up by:...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.injust@mm.html |
|---|
W97M.Grouch |
|---|
Technical details
...Adds the value: Wscript.exe %system%MSGrc32.vbs %1...
...Adds the value: MSGrc32 Wscript.exe %system%MSGrc32.vbs %1...
Removal instructions
...Delete the value: Wscript.exe %system%MSGrc32.vbs %1...
...right pane, delete the value: Wscript.exe %system%MSGrc32.vbs %1...
Source: http://securityresponse.symantec.com/avcenter/venc/data/w97m.grouch.html |
|---|
PIF.Fable.Worm |
|---|
Technical details
...The worm checks if to see if [WindowsDir]Wscript.exe exists. This is the file that is responsible...
...http://service1.symantec.com/sarc/sarc.nsf/html/win.script.hosting.html If Wscript.exe is found, the worm inserts several VBscripts on the system and executes them....
Source: http://securityresponse.symantec.com/avcenter/venc/data/pif.fable.worm.html |
|---|
VBS.SST.B@mm |
|---|
Technical details
...Adds the value: FileSoft Wscript.exe %Windir%UpdataFiles.vbs %1...
Removal instructions
...right pane, delete the value: FileSoft Wscript.exe %Windir%UpdataFiles.vbs %1...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.sst.b@mm.html |
|---|
How to disable or remove the Windows Scripting Host |
|---|
Technical details
...It renames the file association classes for any class that has either Wscript.exe or Cscript.exe in its ShellOpenCommand or ShellOpen2Command registry keys....
...if you have more than one. In the Named box, type wscript.exe,,and then click Find Now....
...Because you have deleted or moved the Wscript.exe file, if you ever try to run a .vbs file, you will see a Program Not Found message....
Source: http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html |
|---|
VBS.Moon.B |
|---|
About VBS.Moon.B
...VBS.Moon.B uses the Windows file Wscript.exe to run its instructions and copies itself to the Windows folder....
Technical details
...explorer "wscript.exe fotompg.vbs %" to the registry key:...
Removal instructions
...explorer "wscript.exe fotompg.vbs %" from the registry key:...
...right pane, delete the value: explorer "wscript.exe fotompg.vbs %" Navigate to and delete the...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.moon.b.html |
|---|
VBS.Neiber.A@mm |
|---|
Technical details
...It adds the value Bernie wscript.exe %system%Bernie.vbs NOTE: %system% is a variable....
Removal instructions
...Delete the value Bernie wscript.exe %system%Bernie.vbs from the registry key...
...right pane, delete the value Bernie wscript.exe %system%Bernie.vbs Exit the Registry Editor....
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.neiber.a@mm.html |
|---|
VBS.Melhack.C@mm |
|---|
Technical details
...It adds the value WinUpdate wscript.exe windowssysmel32.exe.vbs...
Removal instructions
...Delete the value WinUpdate wscript.exe windowssysmel32.exe.vbs...
...right pane, delete the value WinUpdate wscript.exe windowssysmel32.exe.vbs...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.melhack.c@mm.html |
|---|
VBS.Zeta.A@mm |
|---|
Technical details
...ZetaBait wscript.exe <Windows System Folder>FotoPorno2.jpg.vbs %...
Removal instructions
...ZetaBait wscript.exe <Windows System Folder>FotoPorno2.jpg.vbs %...
......
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.zeta.a@mm.html |
|---|
|
|
![[filename.info logo]](/img/logo.png){kind=logo}
![[cn wscript.exe]](/img/nix.gif){kind=small}
