Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 698482" data-attributes="member: 32260">PowerShell scripts blocked when executing, cannot be also edited via powershell_ise.exe or notepad.exe - both execution and edition is blocked by NVTOSA 1.1. But, VBS scripts blocked when executing, can be edited by notepad.exe.
Tested PowerShell script:
[CODE]$mpX = New-Object System.Net.WebClient; $mpX.Headers[&#039;User-Agent&#039;] = &#039;ff-user&#039;; $mpX.DownloadFile(&#039;http://downloads.novirusthanks.org/files/osarmor_setup.exe&#039;, $env:USERPROFILE + &#039;\Downloads\osarmor_setup.exe&#039;); (New-Object -com Shell.Application).ShellExecute($env:USERPROFILE + &#039;\Downloads\osarmor_setup.exe&#039;,&quot;&quot;)[/CODE]
Tested VBS script:
[CODE]Set WshShell = CreateObject(&quot;WScript.Shell&quot;)[/COLOR][/LEFT]
[COLOR=rgb(29, 33, 41)]
[LEFT]WshShell.Run(&quot;c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -command (New-Object System.Net.WebClient).DownloadFile(&#039;https://kcsoftwares.com/files/sumo_lite.exe&#039;,$env:USERPROFILE + &#039;\Downloads\sumo_lite.exe&#039;)&quot;)
WScript.Sleep(10000)
path = WshShell.ExpandEnvironmentStrings(&quot;%userprofile%\\Downloads\\sumo_lite.exe&quot;)
WshShell.Run(path)
WScript.Quit[/CODE]</blockquote>

[QUOTE="Andy Ful, post: 698482, member: 32260"] [LEFT][COLOR=rgb(29, 33, 41)]PowerShell scripts blocked when executing, cannot be also edited via powershell_ise.exe or notepad.exe - both execution and edition is blocked by NVTOSA 1.1. But, VBS scripts blocked when executing, can be edited by notepad.exe.[/COLOR] T[COLOR=rgb(29, 33, 41)]ested PowerShell script: [CODE]$mpX = New-Object System.Net.WebClient; $mpX.Headers['User-Agent'] = 'ff-user'; $mpX.DownloadFile('http://downloads.novirusthanks.org/files/osarmor_setup.exe', $env:USERPROFILE + '\Downloads\osarmor_setup.exe'); (New-Object -com Shell.Application).ShellExecute($env:USERPROFILE + '\Downloads\osarmor_setup.exe',"")[/CODE] Tested VBS script: [CODE]Set WshShell = CreateObject("WScript.Shell")[/COLOR][/LEFT] [COLOR=rgb(29, 33, 41)] [LEFT]WshShell.Run("c:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://kcsoftwares.com/files/sumo_lite.exe',$env:USERPROFILE + '\Downloads\sumo_lite.exe')") WScript.Sleep(10000) path = WshShell.ExpandEnvironmentStrings("%userprofile%\\Downloads\\sumo_lite.exe") WshShell.Run(path) WScript.Quit[/CODE][/COLOR][/LEFT][COLOR=rgb(29, 33, 41)][/COLOR] [/QUOTE]

Verification