Unknown process calling Windows 11 wscript.exe

Some process calls wscript.exe (Windows Script Host) every 2 minutes. I disabled Script host but still have a dialog pop up every 2 minutes saying it is disabled. How can I find what this process is so I can delete it?

Well I would want to understand if it's a legitimate process or not, there is a possibility it is. Regardless of that fact, procmon should be able to help you determine the calling process

orestgogosha said:

Some process calls wscript.exe (Windows Script Host) every 2 minutes. I disabled Script host but still have a dialog pop up every 2 minutes saying it is disabled. How can I find what this process is so I can delete it?

Click to expand...

HI!
wscript is part of Windows but, it can also be part of a replicating trojan so, run scans
with either of these online scanners or both and if you don't have Malwarebytes, you
can download their free scanner. If you can, manually create a new Restore Point before
running these scans.Hopefully, someone from this forum will assist:

orestgogosha said:

Some process calls wscript.exe (Windows Script Host) every 2 minutes. I disabled Script host but still have a dialog pop up every 2 minutes saying it is disabled

Click to expand...

Please post a screenshot of that dialog - preferably one from before you disabled WSH since it is likely to contain more useful info.

my ditty - identify a dialog caller using WinSpy - my post #8 - TenForums


Best of luck,
Denis

I downloaded WinSpy++ and followed your instructions. The process tab does not show the command line and I couldn't find any way to do it.

I have downloaded ProcessMonitor and run it but have no idea what to look for in the output.

orestgogosha said:

I downloaded WinSpy++

Click to expand...

I know nothing about WinSpy++
WinSpy, however, successfully identified the vbs command line for me as shown in my example.

You haven't posted a diagram yet.


Denis

I have scanned my computer with 3 anti-virus tools (TotalAV, Avast, and Malwarebytes) with negative results.

It's no use investigated the msg that WScript has been disabled. You'll need to re-enable it so that you can investigate the source of the popup you first reported.
You haven't posted a diagram yet.


Denis

orestgogosha said:

I have downloaded ProcessMonitor and run it but have no idea what to look for in the output.

Click to expand...

You can add a filter for 'Command Line' that includes wscript and add the column for Parent PID. The parent PID will be your calling process.

app.js could be anything. It's not on my PC (the problem child) nor on my laptop. I assume it was malware that was deleted during the numerous scans I performed.

orestgogosha said:

View attachment 88019View attachment 88020
app.js could be anything. It's not on my PC (the problem child) nor on my laptop. I assume it was malware that was deleted during the numerous scans I performed.

Click to expand...

The extension .js is a java file which, if you were building a web page would be used to this effect.
This is from a web designer:

So basically the app.js is where the logic of the app is written,
index.html is the content page.

app.js is taking the inputs from index.html, and processing the information in app.js, and providing an output to show in the index.html.
if you check the index.html you can see there's a script:
<script src="/app.js"></script>

Have you surfed to a web site that you don't normally would?
This might be from an infected site or could just be benign, I don't
know. Did you verify the logs of the scans you took?

.js files can also be node js and is more likely. Seeing the contents of the file would indicate if it's strictly javascript or nodejs

I have a home web site that I created so I am somewhat familiar with Javascript. There is no file called app.js anywhere on my computer or my website. I review quarantined items before deleting them. I don't recall if app.js was among them. The good part of this is that I am learning to use WinSpy and ProcMon.
As a matter of interest, the frequency of the dialog popping up has decreased to about once every 10 minutes. I don't know if this is good news or bad news.

Use autoruns with the virus total scan option, that should help determine whats there and if anything is suspicious.


You can also use process explorer to find more info on the process and whats being called:

orestgogosha said:

View attachment 88019View attachment 88020
app.js could be anything. It's not on my PC (the problem child) nor on my laptop. I assume it was malware that was deleted during the numerous scans I performed.

Click to expand...

You were previously infected? That's good to know. What was the threats removed? And using what removed them?

1. Change the Default Value of the VBS File:
   • 1. Press Win + R to open the Run command.
     2. Type regedit and hit OK to open the Registry Editor.
     3. Navigate to Computer > HKEY_CLASSES_ROOT > .vbs.
     4. Double-click the (Default) value and set it to VBSfile.
     5. Restart your PC
        
        OR
        
        Use this REG fix.
        
        Code:

        Windows Registry Editor Version 5.00
        [HKEY_CLASSES_ROOT\.vbs]
        @="VBSFile"
        
        [HKEY_CLASSES_ROOT\VBSFile\Shell]
        @="Open"
        
        [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\UserChoice]

        Copy the above lines to Notepad, and save it with .reg extension. Double-click the file to apply the settings.
        
        
2. Fix Corrupted System Files:
   • Use the SFC (System File Checker) and DISM (Deployment Image Servicing and Management)tools:
     • Open Command Prompt as an administrator.
     • Run:
       sfc /scannow
       to scan and repair system files.
     • Then run:
       DISM /Online /Cleanup-Image /RestoreHealth

Thank you. I've done these things and the problem with the dialog has stopped. Please consider this closed.

Well it's back as the standard windows dialog asking you to select run the nonexistent app.js file. I cannot capture it this time because taking any a action with the mouse makes it disappear. Pain in the butt.

orestgogosha said:

Well it's back as the standard windows dialog asking you to select run the nonexistent app.js file. I cannot capture it this time because taking any a action with the mouse makes it disappear. Pain in the butt.

Click to expand...

Hi orestgogosha,

Can you do Alt+PrintScreen combo on the keyboard to capture it?

Kind regards,

tecknot

I tried but the screenshot disappeared. Will try again.