[filename.info logo]
[cn wscript.exe][de wscript.exe][es wscript.exe][fr wscript.exe][gb wscript.exe][it wscript.exe][jp wscript.exe][kr wscript.exe][nl wscript.exe][pt wscript.exe][ru wscript.exe][us wscript.exe]
 

wscript.exe (5.6.0.6626)

Contained in software

Name:Windows XP Home Edition, Deutsch
License:commercial
Information link:http://www.microsoft.com/windowsxp/

File details

Filepath:C:\WINDOWS\system32 \ wscript.exe
Filedate:2002-08-29 14:00:00
Version:5.6.0.6626
Filesize:118.834 bytes

Checksum and file hashes

CRC32:CEC250F2
MD5:BF75 2BED 043E 2DDE 3009 FC10 EAC4 400A
SHA1:1F6D 251E D139 6905 1548 5962 8C71 CC66 F955 89B5

Version resource information

CompanyName:Microsoft Corporation
FileDescription:Microsoft (r) Windows Based Script Host
FileOS:32-bit Windows
FileType:Application
FileVersion:5.6.0.6626
InternalName:wscript.exe
LegalCopyright:Copyright Microsoft Corp. 2001
OriginalFilename:wscript.exe
ProductName:Microsoft (r) Windows Script Host
ProductVersion:5.6.0.6626

wscript.exe was found in the following malware reports:

VBS.CandyLove

Technical details
...3r1k4            wscript.exe %windows%ilove.vbs to the registry key...
...It will repeat this over and over again until you kill the process of Wscript.exe. (This is the Windows script engine that translates the script into executable code...
...To stop this virus once it is in the forever loop, you must stop the process of Wscript.exe). ...
Removal instructions
...If it is running, stop the Wscript.exe process. (Or restart the computer in Safe mode.)...
...3r1k4            wscript.exe %windows%ilove.vbs from the registry key...
...the following instructions. To stop the Wscript.exe process: Press Ctrl+Alt+Delete one...
...Click the Process tab. Locate the Wscript.exe item, select it, and then click End Task....
...3r1k4            wscript.exe %windows%ilove.vbs Navigate to the following...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.candylove.html

VBS.Injust@mm

Removal instructions
...to %windir%WScript.exe,2 If use Windows 95, 98, or...
...to %windir%WScript.exe "%1" %* If use Windows NT, 2000,or...
...to %SystemRoot%System32WScript.exe,2 If use Windows NT, 2000, or...
...to %SystemRoot%System32WScript.exe "%1" %* Write-up by:...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.injust@mm.html

W97M.Grouch

Technical details
...Adds the value: Wscript.exe  %system%MSGrc32.vbs %1...
...Adds the value: MSGrc32 Wscript.exe  %system%MSGrc32.vbs %1...
Removal instructions
...Delete the value: Wscript.exe  %system%MSGrc32.vbs %1...
...right pane, delete the value: Wscript.exe  %system%MSGrc32.vbs %1...
Source: http://securityresponse.symantec.com/avcenter/venc/data/w97m.grouch.html

PIF.Fable.Worm

Technical details
...The worm checks if to see if [WindowsDir]Wscript.exe exists. This is the file that is responsible...
...http://service1.symantec.com/sarc/sarc.nsf/html/win.script.hosting.html If Wscript.exe is found, the worm inserts several VBscripts on the system and executes them....
Source: http://securityresponse.symantec.com/avcenter/venc/data/pif.fable.worm.html

VBS.SST.B@mm

Technical details
...Adds the value: FileSoft Wscript.exe  %Windir%UpdataFiles.vbs %1...
Removal instructions
...right pane, delete the value: FileSoft Wscript.exe  %Windir%UpdataFiles.vbs %1...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.sst.b@mm.html

How to disable or remove the Windows Scripting Host

Technical details
...It renames the file association classes for any class that has either Wscript.exe or Cscript.exe in its ShellOpenCommand or ShellOpen2Command registry keys....
...if you have more than one. In the Named box, type wscript.exe,,and then click Find Now....
...Because you have deleted or moved the Wscript.exe file, if you ever try to run a .vbs file, you will see a Program Not Found message....
Source: http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html

VBS.Moon.B

About VBS.Moon.B
...VBS.Moon.B uses the Windows file Wscript.exe to run its instructions and copies itself to the Windows folder....
Technical details
...explorer     "wscript.exe fotompg.vbs %" to the registry key:...
Removal instructions
...explorer     "wscript.exe fotompg.vbs %" from the registry key:...
...right pane, delete the value: explorer "wscript.exe fotompg.vbs %" Navigate to and delete the...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.moon.b.html

VBS.Neiber.A@mm

Technical details
...It adds the value Bernie wscript.exe %system%Bernie.vbs NOTE: %system% is a variable....
Removal instructions
...Delete the value Bernie wscript.exe %system%Bernie.vbs from the registry key...
...right pane, delete the value Bernie wscript.exe %system%Bernie.vbs Exit the Registry Editor....
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.neiber.a@mm.html

VBS.Melhack.C@mm

Technical details
...It adds the value WinUpdate wscript.exe   windowssysmel32.exe.vbs...
Removal instructions
...Delete the value WinUpdate wscript.exe   windowssysmel32.exe.vbs...
...right pane, delete the value WinUpdate wscript.exe   windowssysmel32.exe.vbs...
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.melhack.c@mm.html

VBS.Zeta.A@mm

Technical details
...ZetaBait       wscript.exe <Windows System Folder>FotoPorno2.jpg.vbs %...
Removal instructions
...ZetaBait       wscript.exe <Windows System Folder>FotoPorno2.jpg.vbs %...
......
Source: http://securityresponse.symantec.com/avcenter/venc/data/vbs.zeta.a@mm.html



Valid HTML 4.01!