Windows Script Host: disable or enable?

[Zorro]

I read that for security you need to disable Windows Script Host, since many malicious programs use this mechanism. However, people also write that after disabling Windows Script Host there will be problems with system updates and the system recovery mechanism. So is it worth disabling Windows Script Host or not?

 

[TairikuOkami]

However, people also write that after disabling Windows Script Host there will be problems with system updates and the system recovery mechanism.

Some software still uses it, but new ones use powershell, NET Framework and such. Windows updates work fine, but not not sure about store apps, they should use UWP. Windows upgrade also performs normally without WSH, but when I tested 3rd party backup software, it used it for tasks.

A closer look at the Locky ransomware

A deep and technical look into the latest ransomware called Locky.

blog.avast.com

WSH is usually the way malware enters the system, without user's interaction.
I rarely need it, mostly for some user generated stuff/scripts, like for games.
When it is needed a user should be notified, either via an error or directly.

 

[shmu26]

The question as presented in the poll is black and white: disable it or not. I voted to disable. But there is a middle position: restrict Windows Script Host. That is the best option, in my opinion.

 

[ForgottenSeer 823865]

This is config dependent, if the user has programs that requires it, it cant be disabled.
i second @shmu26 with restricting it.

 

[manchesterunited]

nah, we got AI\ML

 

[Sampei Nihira]

I'm for blocking, but OSA has many rules for WSH monitoring even if active.
An anti-exploit protection too.
in the pictures under some rules:

 

[Zorro]

There is a point in Syshardener - turn off the Windows Script Host. There is an orange mark as a warning that scripts will not work. If you activate this item, will the Windows Script Host completely shut down or will it work in restrict mode?

 

[Zorro]

The question as presented in the poll is black and white: disable it or not. I voted to disable. But there is a middle position: restrict Windows Script Host. That is the best option, in my opinion.

How to start restricted mode?

 

[shmu26]

There is a point in Syshardener - turn off the Windows Script Host. There is an orange mark as a warning that scripts will not work. If you activate this item, will the Windows Script Host completely shut down or will it work in restrict mode?

It will shut it down completely. SysHardener doesn't allow you to restrict or monitor it, although OSArmor and a number of other security softs do give you such a functionality.
It's the kind of thing that you never know when you might need it. Just a little example: let's say you installed Comodo Firewall, decided it's not for you, and uninstall it. When you reboot, a little cleanup script will run, and remove the Comodo leftovers pretty effectively. If you disabled Windows Script Host, you are left with all the garbage.

 

[Zorro]

although OSArmor and a number of other security softs do give you such a functionality.

OK. What other items in OSArmor, other than those noted by Samprei Nihira, are responsible for limiting the Windows Script Host?

 

[shmu26]

OK. What other items in OSArmor, other than those noted by Samprei Nihira, are responsible for limiting the Windows Script Host?

IDK. Haven't looked at it in a long time. Others following this thread can tell you if there are any other items like that.

 

[upnorth]

I doubt it would be very " smart " turn this off/disable for actual Home/common users. In the Geek world, it's of course different.

At least try avoid fiddle with this on your grandparents pc.

 

[TairikuOkami]

At least try avoid fiddle with this on your grandparents pc.

I disable it on every computer I get my hands on, especially on my grandparents.

Symantec offered the tool to enable/disable it with one click, but it was removed recently.
Some mention it, but they do not want users to disable it . Who would need theirs AV then?!

How-To Disable Windows Script Host - F-Secure Blog

Numerous spam campaigns are pushing various crypto-ransomware families (and backdoors) via .zip file attachments. And such .zip files typically contain a JScript (.js/.jse) file that, if clicked, will be run via Windows Script Host. Do yourself a favor and edit your Windows Registry to disable...

blog.f-secure.com

Disable Windows Script Host (WSH) to block .VBS malware

Windows Script Host (or WSH) (also known as Windows Scripting Host) is a scripting language shipped with all major Windows and Windows Server distributions sinc

www.ryadel.com

2019 - That’s it for now: given the widespread distribution of VBS viruses and malwares attached to e-mails throughout the whole Europe, we can only recommend to preventively disable WSH to all system administrators, unless explicitly required by specific scenarios.

 

[Sampei Nihira]

In OSA Main Protection there are many other rules that allow control of what is generically called WSH.
In Advanced Protection if any rules can cause problems there is a warning (exclamation point) I show one on the subject:

 

[shmu26]

Hard_Configurator offers two ways of controlling Windows Script Host. It can be blocked completely, similar to SysHardener, or it can be restricted. When it is restricted, that means it can be run only with elevated privileges.

 

[Sampei Nihira]

If any MT user is interested in my old vbs test with I.E.8 and MBAE intervention.
MBAE intervention for a VBS exploit has a different layout than other exploits:

I E 8 VB Script

Upload and share videos instantly. It's free and simple. No signup required.

sendvid.com

Good night to you all .

 

[Andy Ful]

Hard_Configurator offers two ways of controlling Windows Script Host. It can be blocked completely, similar to SysHardener, or it can be restricted. When it is restricted, that means it can be run only with elevated privileges.

In H_C Windows Script Host can be disabled by Windows policy or restricted by SRP.
The SRP in H_C settings can restrict it as follows:

1. Block script Interpreter with standard privileges and allow it with higher privileges. No whitelisting available.
2. Allow script Interpreter, but block script files with standard privileges and allow script files with higher privileges. Blocked scripts can be whitelisted by the user.

The blocked events can be seen in H_C, so the user can see the paths of scripts that he/she would like to whitelist (they will not be blocked).

 

[Andy Ful]

I disable it on every computer I get my hands on, especially on my grandparents.

Symantec offered the tool to enable/disable it with one click, but it was removed recently.

This tool did not disable Windows Script Host, but only script files by file extensions (similarly to SysHardener). The scripts could be still run from the command-line, for example:
wscript /e:vbscript ....

How-To Disable Windows Script Host - F-Secure Blog

Numerous spam campaigns are pushing various crypto-ransomware families (and backdoors) via .zip file attachments. And such .zip files typically contain a JScript (.js/.jse) file that, if clicked, will be run via Windows Script Host. Do yourself a favor and edit your Windows Registry to disable...

blog.f-secure.com

Disable Windows Script Host (WSH) to block .VBS malware

Windows Script Host (or WSH) (also known as Windows Scripting Host) is a scripting language shipped with all major Windows and Windows Server distributions sinc

www.ryadel.com

The reg tweaks proposed in both articles are incomplete for Windows 64-bit. The block can be bypassed by using a command-line with 32-bit versions of script Interpreters from the "c:\Windows\SysWOW64" folder.