Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 774732" data-attributes="member: 32260">How to block the Windows script interpreters in KIS:<ol>
<li data-xf-list-type="ol">Open Kaspersky &gt;&gt; Settings &gt;&gt; Protection &gt;&gt; Application Control &gt;&gt; Manage Applications.</li>
<li data-xf-list-type="ol">Right-click the &#039;Untrusted&#039; group and choose the option &quot;Add application to group&quot;&#039;.</li>
<li data-xf-list-type="ol">Find and open wscript.exe from the folder c:\windows\system32.</li>
<li data-xf-list-type="ol">You will see the new entry &quot;Microsoft Windows Based Script Host&quot; (Blocked).</li>
<li data-xf-list-type="ol">For 64-bit Windows, find and open also wscript.exe from c:\Windows\SysWOW64.</li>
</ol>How to unblock:<ol>
<li data-xf-list-type="ol">Open Kaspersky &gt;&gt; Settings &gt;&gt; Protection &gt;&gt; Application Control &gt;&gt; Manage Applications</li>
<li data-xf-list-type="ol">Expand the &#039;Untrusted&#039; group.</li>
<li data-xf-list-type="ol">Delete all &quot;Microsoft Windows Based Script Host&quot; entries.</li>
<li data-xf-list-type="ol">Do not use the toggle to change the option from Blocked to Allowed - this will not unblock the application from &#039;Untrusted&#039; group.</li>
</ol>Add in the similar way the executables&nbsp; cscript.exe,&nbsp; powershell.exe, powershell_ise.exe, and mshta.exe. The entries: &quot;Microsoft Console Based Script Host&#039;&quot;, &quot;Windows PowerShell&quot;, and &quot;Microsoft (R) HTML Application host&quot; will be added with the &#039;Blocked&#039; setting.There are also other interpreters like hh.exe, scrcons.exe, etc. But, they are rarely used.Post edited and optimized thank to [USER=56349]@Lockdown[/USER] suggestion.</blockquote>

[QUOTE="Andy Ful, post: 774732, member: 32260"] [B]How to block the Windows script interpreters in KIS:[/B] [LIST=1] [*]Open Kaspersky >> Settings >> Protection >> Application Control >> Manage Applications. [*]Right-click the 'Untrusted' group and choose the option "Add application to group"'. [*]Find and open [B][COLOR=rgb(0, 168, 133)]wscript.exe[/COLOR][/B] from the folder c:\windows\system32. [*]You will see the new entry "Microsoft Windows Based Script Host" (Blocked). [*]For 64-bit Windows, find and open also wscript.exe from c:\Windows\SysWOW64. [/LIST] How to unblock: [LIST=1] [*]Open Kaspersky >> Settings >> Protection >> Application Control >> Manage Applications [*]Expand the 'Untrusted' group. [*]Delete all "Microsoft Windows Based Script Host" entries. [*]Do not use the toggle to change the option from Blocked to Allowed - this will not unblock the application from 'Untrusted' group. [/LIST] Add in the similar way the executables [B][COLOR=rgb(0, 168, 133)]cscript.exe[/COLOR][/B], [COLOR=rgb(0, 168, 133)][B]powershell.exe[/B][/COLOR], [COLOR=rgb(0, 168, 133)][B]powershell_ise.exe[/B][/COLOR], and [B][COLOR=rgb(0, 168, 133)]mshta.exe[/COLOR][/B]. The entries: "Microsoft Console Based Script Host'", "Windows PowerShell", and "Microsoft (R) HTML Application host" will be added with the 'Blocked' setting. There are also other interpreters like hh.exe, scrcons.exe, etc. But, they are rarely used. Post edited and optimized thank to [USER=56349]@Lockdown[/USER] suggestion. [/QUOTE]

Verification