Block .vbs types of malware by disabling WSH - ... https://success.trendmicro.

com/solution/1099904

Search Support

Blocking .vbs malware by disabling the Windows Script Host

(WSH) in OfficeScan (OSCE)
Updated: 12 Apr 2016 Product/Version: OfficeScan 10.6 Platform: Windows 7 32-bit,

SUMMARY

This article shows how to prevent .vbs malware from executing.

DETAILS

To block malware running via VBS, disable the script host by doing any of the following:

Option I: Disable Windows Script Host

To block .vbs malware by disabling WSH, create one of the following two registry entries (REG_DWORD) and
set the value to "0".

To disable WSH for a particular user, create this entry: HKEY_CURRENT_USER\Software\Microsoft

\Windows Script Host\Settings\Enabled

To disable WSH for all users of a particular computer, create this entry:
Contact Support Download Center
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Product Documentation
Script Host\Settings\Enabled

When enforced, the following message(http://downloadcenter.trendmicro.com/)

(/contact-support-asia-pacific) will be displayed during any attempts to(http://docs.trendmicro.com/en-us
run a WSH script:
/home.aspx)
Need Help?
"Windows Script Host access is disabled on this machine. Contact your administrator for details."

Option II: Block by Behavior Monitoring

Support Policies Product Vulnerability Ideas Exchange

To disable WSH using Behavior Monitoring:
(/support-policies) (/vulnerability-response) (/IdeasExchange)
1. Log on to the OfficeScan management console. (http://www.trendmicro.com/)

2. GoPacific
Asia to Networked Computers > Client Management > Settings > Behavior Monitoring Settings.

3. Add the following Block Programs:

Business Support Home (/business-support)
C:\Windows\system32\cscript.exe
Legal Policies & Privacy (http://www.trendmicro.com/us/about-us/legal-policies/index.html)
C:\Windows\system32\wscript.exe
Site Map (/sitemap)
4. Click Save.
FAQ (/faq)
WSH should now be disabled.
Feedback (/survey/solution/1099904)
Copyright 2017 Trend Micro Incorporated.
All rights reserved.

1 of 2 09/06/17, 5:46 PM
Block .vbs types of malware by disabling WSH - ... https://success.trendmicro.com/solution/1099904

Rating:
4 found this helpful

Category:
Configure; Remove a Malware / Virus

Solution Id:
1099904

FEEDBACK

Did this article help you? Yes No

RELATED ARTICLES

Technical Support: OfficeScan 10.6 (/product-support/officescan-10-6)

Disabling Windows Script Host (http://technet.microsoft.com/en-us/library/ee198684.aspx)

Configuring approved or blocked programs in OfficeScan 10.6 Behavior Monitoring (/solution/1095359-

configuring-approved-or-blocked-programs-in-officescan-10-6-behavior-monitoring)

Using the OfficeScan (OSCE) toolbox or Case Diagnostic Tool (CDT) (/solution/1095849-using-the-officescan-
osce-toolbox-or-case-diagnostic-tool-cdt)

(/TS_Portal_ImproveExperienceModal)

Need Help?

2 of 2 09/06/17, 5:46 PM