Avatar of thyet
thyetFlag for Spain asked on

wscript.exe in the startup of windows XP, 99% of the resources

Hi all,

curiosly since yesterday this process appears in the moment in which one of our computers is restarted. The process is wscript.exe and the consumption of this process is the 99% of the resources. This process blocks the computer completelly, specially in terms of the internet and outlook connections. All the applications are blocked.

I dont really know if it is a virus or not, i could read different things. The first is next fro microsoft:

wscript.exe file information. The process Microsoft (r) Windows Based Script Host belongs to the software Microsoft (r) Windows Script Host or wscript.exe by Microsoft Corporation (www.microsoft.com).
Description: File wscript.exe is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 114688 bytes (68% of all occurrence), 118834 bytes, 151552 bytes.
The file is a trustworthy file from Microsoft. The program has no visible window. Therefore the technical security rating is 5% dangerous.

If wscript.exe is located in a subfolder of C:\Windows then the security rating is 16% dangerous. File size is 114688 bytes. The program is not visible. File wscript.exe is a trustworthy file from Microsoft. File wscript.exe is not a Windows core file.


and this another found in the Internet (http://www.auditmypc.com/process/wscript.asp):
 
wscript.exe - Here is the scoop on Vbswg.Aq Worm as it pertains to computer network security. The big question: what is wscript.exe and is it spyware, a trojan and if so, how do I get rid of Vbswg.Aq Worm?
wscript.exe (Vbswg.Aq Worm) - Details
If a process named wscript.exe is running on your computer, you may have been infected with a strain of the Vbswg.Aq worm.

wscript.exe is considered to be a security risk, not only because antivirus programs flag Vbswg.Aq Worm as a virus, but also because a number of users have complained about its performance.

Vbswg.Aq Worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of wscript.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data or leaking private information to websites.

You should visit our Anonymous Surfing section to make sure your system is not giving away information like that of wscript.exe.

WSCRIPT.EXE - Disclaimer
Every attempt has been made to provide you with the correct information for wscript.exe or VBSWG.AQ WORM. Many spyware / malware programs use filenames of usual, non-malware programs. If we have included information about wscript.exe that is inaccurate, we would greatly appreciate your help by updating the Process Information database and we will do our best to correct it.

You should verify the accuracy of information we provided about wscript.exe. Vbswg.Aq Worm may have had a status change since this page was published.

Could you help on that?
thanks

wscript.doc
Windows XPAnti-SpywareVulnerabilities

Avatar of undefined
Last Comment
thyet

8/22/2022 - Mon
Michael Pfister

Hard to say if its a virus or just a startup script thats running havoc.

wscript.exe per se is not a virus, its Microsofts VBScript engine.

If  the computer is a member in a domain, the script could have been started by a group policy.

Anyway, you should be able to cancel wscript.exe via task manager.
Then do a scan with t least 2 decent virus scanner.
Then check your startup config with AutoRuns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx) and try to find the start of wscript.exe.

Hope it helps
ASKER
thyet

yes, the computer is member of a domain, do you know how we could test this to be sure if it is a group policy?
ASKER CERTIFIED SOLUTION
Michael Pfister

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
thyet

Hi again mpfister and sorry for the delay,

i could try that command but i couldn't see any of those type of files.

thanks,
thyet
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
sramesh2k

Hi thyet,

It might be something like

wscript.exe "C:\folder\somescript.vbs"

The parameter is what you want to find out

Inspect the registry RUN keys:
http://windowsxp.mvps.org/startup.htm

Or use Autoruns tool to track the wscript.exe entry.
ASKER
thyet

Thanks, I'll try it and i'll tell you.

regards,
ASKER
thyet

Thanks all for your help, the problem finally was linked with one of the group policy.

regards
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.