Unknown process calling Windows 11 wscript.exe


Try Print screen. This should bring up snipping tool.
If you have it, it will freeze the screen while you take the shot.
OR once you pressed on shift + print screen, open Paint and paste. save as
and copy / paste here. The image from snipping tool is saved to Screenshots folder.

1709679748142.png
 
Last edited:

My Computers

System One System Two

  • OS
    windows 11 22631.3447
    Computer type
    Laptop
    Manufacturer/Model
    MSI Raider GE76
    CPU
    Core i9 12th gen 12900HK 2.9 MHz
    Motherboard
    MSI
    Memory
    32 Gigs DDR5-4800
    Graphics Card(s)
    nVidia RTX 3070 Ti / 8 Gigs DDR6
    Sound Card
    DYNAUDIO - Klipsch 2.1 THX - Sound Effects by Nahimic 3
    Monitor(s) Displays
    17.3" 1920 x 1080 360 Hz 3 ms, IPS / Connected to MSI 32 inch curved @ 165 Hz
    Screen Resolution
    1920 x 1080 / Both
    Hard Drives
    Samsung 990 Pro 2TB (OS) - Solidigm P41 2TB (Storage)
    PSU
    280 watts
    Case
    MSI GE series
    Cooling
    internal
    Keyboard
    Steelseries
    Mouse
    G903 Lightspeed
    Internet Speed
    1000 Mbps
    Browser
    Firefox / Opera GX- Do not like Edge
    Antivirus
    Malwarebytes'
    Other Info
    just ask.
  • Operating System
    Windows 10 22H2
    Computer type
    Laptop
    Manufacturer/Model
    MSI GT73 7RE VR Titan
    CPU
    Intel Core i7 7820HK 2.9 Ghz
    Motherboard
    MSI
    Memory
    16 Gigs DDR4 2400 Mhz
    Graphics card(s)
    nVidia 1070 8GB RAM
    Sound Card
    DYNAUDIO / Nahimic 2
    Monitor(s) Displays
    IPS / 120HZ
    Screen Resolution
    1920x1080P
    Hard Drives
    Samsung NVME EVO 970 1TB / Samsung SSD (SATA) 1TB
    PSU
    240 watts
    Case
    MSI
    Cooling
    Internal
    Mouse
    Logitech G903 Lightspeed
    Keyboard
    Steelseries
    Internet Speed
    1 Gb/s
    Browser
    Firefox / Vivaldi
    Antivirus
    MalwareBytes'
    Other Info
    none.
I captured it. This appears every few minutes. It is trying to run a file capped app.js in the User/Public folder like the WSCRIPT dialog did. The file does not exist on either of my PCs or my laptop. Running a browser or image processing software seems to activate it.
 

Attachments

  • 2024-03-05.png
    2024-03-05.png
    86.2 KB · Views: 2

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built

My Computers

System One System Two

  • OS
    windows 11 22631.3447
    Computer type
    Laptop
    Manufacturer/Model
    MSI Raider GE76
    CPU
    Core i9 12th gen 12900HK 2.9 MHz
    Motherboard
    MSI
    Memory
    32 Gigs DDR5-4800
    Graphics Card(s)
    nVidia RTX 3070 Ti / 8 Gigs DDR6
    Sound Card
    DYNAUDIO - Klipsch 2.1 THX - Sound Effects by Nahimic 3
    Monitor(s) Displays
    17.3" 1920 x 1080 360 Hz 3 ms, IPS / Connected to MSI 32 inch curved @ 165 Hz
    Screen Resolution
    1920 x 1080 / Both
    Hard Drives
    Samsung 990 Pro 2TB (OS) - Solidigm P41 2TB (Storage)
    PSU
    280 watts
    Case
    MSI GE series
    Cooling
    internal
    Keyboard
    Steelseries
    Mouse
    G903 Lightspeed
    Internet Speed
    1000 Mbps
    Browser
    Firefox / Opera GX- Do not like Edge
    Antivirus
    Malwarebytes'
    Other Info
    just ask.
  • Operating System
    Windows 10 22H2
    Computer type
    Laptop
    Manufacturer/Model
    MSI GT73 7RE VR Titan
    CPU
    Intel Core i7 7820HK 2.9 Ghz
    Motherboard
    MSI
    Memory
    16 Gigs DDR4 2400 Mhz
    Graphics card(s)
    nVidia 1070 8GB RAM
    Sound Card
    DYNAUDIO / Nahimic 2
    Monitor(s) Displays
    IPS / 120HZ
    Screen Resolution
    1920x1080P
    Hard Drives
    Samsung NVME EVO 970 1TB / Samsung SSD (SATA) 1TB
    PSU
    240 watts
    Case
    MSI
    Cooling
    Internal
    Mouse
    Logitech G903 Lightspeed
    Keyboard
    Steelseries
    Internet Speed
    1 Gb/s
    Browser
    Firefox / Vivaldi
    Antivirus
    MalwareBytes'
    Other Info
    none.
You can grab my process stop and start filter for Process Monitor here. Before you start capturing events again, click the Filter button (looks like a funnel), and add a filter for Command Line, contains, app.js, Include. In the Options menu, choose Select Columns, and make sure Image Path and Command Line are selected. Then, you can clear the existing events and start capturing. The result should be a much more concise log of processes starting and stopping, where the app.js file is mentioned on the command line.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 [rev. 3447]
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC12WSHi7
    CPU
    12th Gen Intel Core i7-1260P, 2100 MHz
    Motherboard
    NUC12WSBi7
    Memory
    64 GB
    Graphics Card(s)
    Intel Iris Xe
    Sound Card
    built-in Realtek HD audio
    Monitor(s) Displays
    Dell U3219Q
    Screen Resolution
    3840x2160 @ 60Hz
    Hard Drives
    Samsung SSD 990 PRO 1TB
    Keyboard
    CODE 104-Key Mechanical Keyboard with Cherry MX Clears
  • Operating System
    Linux Mint 21.2 (Cinnamon)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Intel NUC8i5BEH
    CPU
    Intel Core i5-8259U CPU @ 2.30GHz
    Memory
    32 GB
    Graphics card(s)
    Iris Plus 655
    Keyboard
    CODE 104-Key Mechanical Keyboard - Cherry MX Clear
I think this may be coming in as a cookie. I clean the cookies and it goes away for a while then returns in a few hours. Have not been correlated to a site,
 

My Computer

System One

  • OS
    Windows 11
    Computer type
    PC/Desktop
    Manufacturer/Model
    Self Built
Back
Top Bottom