Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Blocking .vbs malware by disabling the Windows Script Host (WSH) in OfficeScan (OSCE)

    • Updated:
    • 12 Apr 2016
    • Product/Version:
    • OfficeScan 10.6
    • Platform:
    • Windows 7 32-bit
    • Windows 7 64-bit
    • Windows 8 32-bit
    • Windows 8 64-bit
    • Windows 8.1 32-bit
    • Windows 8.1 64-bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
Summary

This article shows how to prevent .vbs malware from executing.

Details
Public

To block malware running via VBS, disable the script host by doing any of the following:

Option I: Disable Windows Script Host

To block .vbs malware by disabling WSH, create one of the following two registry entries (REG_DWORD) and set the value to "0".

  • To disable WSH for a particular user, create this entry: HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Enabled
  • To disable WSH for all users of a particular computer, create this entry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings\Enabled

When enforced, the following message will be displayed during any attempts to run a WSH script:

"Windows Script Host access is disabled on this machine. Contact your administrator for details."

Option II: Block by Behavior Monitoring

To disable WSH using Behavior Monitoring:

  1. Log on to the OfficeScan management console.
  2. Go to Networked Computers > Client Management > Settings > Behavior Monitoring Settings.
  3. Add the following Block Programs:
    • C:\Windows\system32\cscript.exe
    • C:\Windows\system32\wscript.exe
  4. Click Save.

WSH should now be disabled.

Premium
Internal
Rating:
Category:
Configure; Remove a Malware / Virus
Solution Id:
1099904
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.