DOCSLIB.ORG

To Protect Your PC Disable the Windows Scripting Host by Stephen

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
To Protect Your PC Disable the Windows Scripting Host by Stephen To Protect Your PC Disable the Windows Scripting Host By Stephen Bucaro The Windows Scripting Host (WSH) is a feature that enables VBScripts to run on W indows operating systems. VBScripts contain instructions that can modify almost anything on your computer without your knowledge. hey are frequently used by system administrators to automate PC administration t asks. Scripts are plain text files and VBScript is a very simple progamming language, so anyone can use Windows Notepad to create a script to read, modify, create, or delete files on your PC, including the registry and other configuration files. A script can be executed by clicking on the name of the script within an email m essage. Hackers can use the WSH to infect or cause damage to your PC. You can increase the security of your PC by disabling the WSH; however, this pre vents you from taking advantage of its powerful capabilites, and some legitimate applications use the WSH. In this article, you'll learn a technique to quickly enable the WSH, use it to perform administration tasks, and disable it again. Disclaimer: This article involves editing the registry. Incorrectly editing the registry can cause your computer to fail to start. The use of this information i s entirely at your own risk. To be safe, you should backup your computers regist ry before using this information. In no event shall Bucaro TecHelp be liable for any damages whatsoever arising out of the use of or inability to use the inform ation in this article. The first step is to export the registry key that controls whether the WSH is en abled or disabled. 1. Select Start | Run... and in the Run dialog box that appears, type regedit an d click on the [OK] button. 2. In the Registry Editor, navigate to and highlight the following key. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings\Enabled 3. In the Registry Editor "Registry" menu select "Export Registry File...". 4. In the "Export Registry File" dialog box that appears, in the "File name:" t ext box enter a file path and name, for example "c:\wshkey". Make sure "Registra tion files" is selected in the "Save as type:" drop down list. 5. Make sure the "Selected branch" radio button is set in the bottom section of the "Export Registry File" dialog box. 6. Click on the [Save] button. The Registry Editor will have created the file wshkey.reg in the root of the c: directory. You can open the file in Windows Notepad and see that it contains the following information (or something similar to it). Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings] "DisplayLogo"="1" "ActiveDebugging"="1" "SilentTerminate"="0" "TrustPolicy"=dword:00000000 "LogSecurityFailures"="1" "LogSecuritySuccesses"="0" "Remote"="0" "Enabled"="1" "IgnoreUserSettings"="0" Note that the "Enabled" key is set to "1", indicating that the WSH is enabled. I f this key is set to "0" on your machine, then the WSH is disabled. In order to run scripts on your computer, you'll need to edit this setting and import the ke y back into the registry. To see if the WSH is actually running and enabled, open Windows Notepad and crea te a new file by typing in the following lines. Set wshShell = Wscript.CreateObject("Wscript.Shell") MsgBox("Hello from WSH!") Save the file with the name test.vbs (you may need to save it as test.txt and th en change the file extension). When you double-click on the file name, a message box should appear. Open Windows Notepad and create a new file by typing in the following lines (or just cut and paste the lines below). If MsgBox("Disable WSH?", vbQuestion + vbYesNo, "Windows Scripting Host") = vbYes Then Dim WshShell, RegKey Set WshShell = CreateObject("WScript.Shell") RegKey = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings\Enabled" WshShell.RegWrite Regkey, "0" End If Save the file with the name disable.vbs. When you double-click on the file name, a message box will appear asking if you want to disable the WSH. Click on the [ Yes] button. Now when you execute test.vbs, the little box with the message box "Hello from W SH!" will not appear. Instead, Windows will display the message "Windows Script Host access is disabled on this machine". Inspecting the key again in the Regist ry Editor will verify that its value has been set to "0". Your PC is now better protected from hackers. 1. In the Registry Editor "Registry" menu select "Import Registry File...". 2. In the "Import Registry File" dilaog box that appears, select the file wshke y.reg, then click on the [Open] button. Inspecting the key again in the Registry Editor will verify that its value has b een set to "1". You are now able to use the powerful capabilites of the WSH. Now when you execute test.vbs, the message "Hello from WSH!" will appear. Keep the wshkey.reg and disable.vbs files in a convenient place so that when you need to run a script you can quickly import wshkey.reg into the registry to ena ble the WSH, execute your script, then execute disable.vbs to protect your syste m. Or you could easily include, at end of your script, the three lines from disa ble.vbs that disable the WSH (you don't really need the message box). With this technique, you can quickly enable the WSH, run a program that uses the WSH or use a script to perform administration tasks, and disable it again..
Load more

Recommended publications
  • Powershell Delete Registry Key Remote Computer
    Powershell delete registry key remote computer In Use PowerShell to Edit the Registry on Remote Computers, I talked cmdlet to find and delete the registry key on all remote servers that are. There is a pre powershell registry tool called reg. It will perform registry operations on remote computers. REG DELETE /? REG DELETE. I am trying to create a PowerShell script that deletes two keys on a remote computer. (One key in the code below) I have successfully created a. The Remove-RegistryKey cmdlet is used to delete registry keys and values on the local or a remote computer. I'm working on remotely modifying an autologin key value on batches of {Remove-ItemProperty -Path "HKLM:\Software\Microsoft\Windows Solution: $Computers = Get-Content "C:\"$Path me with a powershell script that can modify registry key on a list of remote computers Basically, I need to modify a product name in add/remove programs list. Then I need to find out whether I got the admin permission on the remote machines. Lastly, remove the specified reg keys. #Read the machine. Deleting Specific Remote Registry Entry - Powershell playing about with trying to write a script to delete a specific software GPO deployed to a remote computer. $Items = $Keys | Foreach-Object {Get-ItemProperty $_. $RegistryKeyValue = $ue($RegistryKeyName) Write-output "Attempting to delete $RegistryKeyName on $Computer `r ". Powershell: Delete Registry Key On Remote Server To run a script on one or many remote computers, use the FilePath parameter of the. I am having trouble changing registry keys. I know the trouble is Set-ItemProperty does not support connections to remote computers.
    [Show full text]
  • Tracking Computer Use with the Windows® Registry Dataset Doug
    Tracking Computer Use with the Windows® Registry Dataset Doug White Disclaimer Trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose. Statement of Disclosure This research was funded by the National Institute of Standards and Technology Office of Law Enforcement Standards, the Department of Justice National Institute of Justice, the Federal Bureau of Investigation and the National Archives and Records Administration. National Software Reference Library & Reference Data Set The NSRL is conceptually three objects: • A physical collection of software • A database of meta-information • A subset of the database, the Reference Data Set The NSRL is designed to collect software from various sources and incorporate file profiles computed from this software into a Reference Data Set of information. Windows® Registry Data Set It is possible to compile a historical list of applications based on RDS metadata and residue files. Many methods can be used to remove application files, but these may not purge the Registry. Examining the Registry for residue can augment a historical list of applications or provide additional context about system use. Windows® Registry Data Set (WiReD) The WiReD contains changes to the Registry caused by application installation, de-installation, execution or other modifying operations. The applications are chosen from the NSRL collection, to be of interest to computer forensic examiners. WiReD is currently an experimental prototype. NIST is soliciting feedback from the computer forensics community to improve and extend its usefulness.
    [Show full text]
  • Operational and Administrative Guidance
    Operational and Administrative Guidance Microsoft Windows Server, Microsoft Windows 10 version 1909 (November 2019 Update), Microsoft Windows Server 2019 version 1809 Hyper-V Common Criteria Evaluation under the Protection Profile for Virtualization, including the Extended Package for Server Virtualization Revision date: January 15, 2021 © 2021 Microsoft. All rights reserved. Microsoft Windows Server and Windows 10 Hyper-V Administrative Guidance Copyright and disclaimer The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs-NonCommercial VLicense (which allows redistribution of the work). To view a copy of this license, visithttp://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious.
    [Show full text]
  • Oracle Database Platform Guide for Windows
    Oracle® Database Platform Guide 10g Release 1 (10.1) for Windows Part No. B10113-01 December 2003 Oracle Database Platform Guide, 10g Release 1 (10.1) for Windows Part No. B10113-01 Copyright © 1996, 2003 Oracle Corporation. All rights reserved. Primary Author: Craig B. Foch Contributing Author: Mark Kennedy and Helen Slattery Contributor: David Collelo The Programs (which include both the software and documentation) contain proprietary information of Oracle Corporation; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent and other intellectual and industrial property laws. Reverse engineering, disassembly or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited. The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose. If the Programs are delivered to the U.S. Government or anyone licensing or using the programs on behalf of the U.S. Government, the following notice is applicable: Restricted Rights Notice Programs delivered subject to the DOD FAR Supplement are "commercial computer software" and use, duplication, and disclosure of the Programs, including documentation, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement.
    [Show full text]
  • Compressed Modes User's Guide
    Drivers for Windows Compressed Modes User’s Guide Version 2.0 NVIDIA Corporation August 27, 2002 NVIDIA Drivers Compressed Modes User’s Guide Version 2.0 Published by NVIDIA Corporation 2701 San Tomas Expressway Santa Clara, CA 95050 Copyright © 2002 NVIDIA Corporation. All rights reserved. This software may not, in whole or in part, be copied through any means, mechanical, electromechanical, or otherwise, without the express permission of NVIDIA Corporation. Information furnished is believed to be accurate and reliable. However, NVIDIA assumes no responsibility for the consequences of use of such information nor for any infringement of patents or other rights of third parties, which may result from its use. No License is granted by implication or otherwise under any patent or patent rights of NVIDIA Corporation. Specifications mentioned in the software are subject to change without notice. NVIDIA Corporation products are not authorized for use as critical components in life support devices or systems without express written approval of NVIDIA Corporation. NVIDIA, the NVIDIA logo, GeForce, GeForce2 Ultra, GeForce2 MX, GeForce2 GTS, GeForce 256, GeForce3, Quadro2, NVIDIA Quadro2, Quadro2 Pro, Quadro2 MXR, Quadro, NVIDIA Quadro, Vanta, NVIDIA Vanta, TNT2, NVIDIA TNT2, TNT, NVIDIA TNT, RIVA, NVIDIA RIVA, NVIDIA RIVA 128ZX, and NVIDIA RIVA 128 are registered trademarks or trademarks of NVIDIA Corporation in the United States and/or other countries. Intel and Pentium are registered trademarks of Intel. Microsoft, Windows, Windows NT, Direct3D, DirectDraw, and DirectX are registered trademarks of Microsoft Corporation. CDRS is a trademark and Pro/ENGINEER is a registered trademark of Parametric Technology Corporation. OpenGL is a registered trademark of Silicon Graphics Inc.
    [Show full text]
  • Windows Registry,Some Basic Understanding
    WINDOWS REGISTRY,SOME BASIC UNDERSTANDING For the peoples who use Windows, „Windows Registry‟ is not a new word at all. The registry is a central database of all configuration settings for most of the applications installed on the computer. Windows stores all its settings in this „Registry‟ itself. The „Windows Registry Editor‟ allows us to configure many hidden settings for windows and other applications installed, which are not accessible by the interface of the particular software itself. You can easily manipulate and modify the values of registry and improve the PC‟s performance. However, do it carefully, because modify the right setting and your computer gets a boost, modify the wrong one and you end up with a non-booting system. In my previous post I wrote about „Autoruns‟, it can also manipulate registry. (Read here) To edit registry, we can use „Windows Registry Editor‟, which is preinstalled in Windows itself. It can be launched by using the command „regedit‟ in the „RUN‟ dialog box, which can be launched by pressing “Windows key+R”. On start-up, „Windows Registry‟ will show up the following five root entries. HKEY_CLASSES_ROOT HKEY_CURRENT_USER HKEY_LOCAL_MACHINE HKEY_USERS HKEY_CURRENT_CONFIG All the settings given above are not stored in a single file. They are spread across multiple files in logical groups called „hives‟. The combination of hives makes „Windows Registry‟. The values are stored here in binary format. That means only “1” and “0” is used here. “1” means “yes”, whereas the value “0” represents “no”. Let us look into the details of these settings. 1. HKEY_CLASSES_ROOT: It is abbreviated as HKCR.
    [Show full text]
  • Older Operating Systems
    Older Operating Systems Class Notes # 18 Windows 9X Registry January 6, 2004 The windows 9x registry contains the operating system database. The data stored in the registry includes the following: system configuration, user settings, device manager information, application software settings, hardware settings, etc. The database has a hierarchical tree structure. See below: Figure 1: Registry editor Note that the right of the window are value name (e.g. ScreenSaveTime) and to the right of each value of each name is the value data assigned (e.g. 900). The registry is contained in two files which are hidden: System.dat and User.dat. The registry is organized in six major keys or branches of the registry tree and are described on table one: 1 Table one: Six major keys of the Windows 9x registry Key Description HKEY_CLASSES_ROOT Contains information about file associations and OLE data (This branch of the tree is a copy of HKEY_LOCAL_MACHINE\Software\Classes HKEY_USER Includes user preferences, including desktop configuration and network connections HKEY_CURRENT_USER If there is only one user of the system, this is a duplicate of HKEY_USERS, but for a multi-user system, this key contains information about the current user preferences. HKEY_LOCAL_MACHINE Contains information about hardware and installed software HKEY_CURRENT_CONFIG Contains the same information in HKEY_LOCAL_MACHINE\Config and has information about printers and display fonts HKEY_DYN_DATA Keeps information about Windows performance and Plug and Play information You can think of the six major keys in table one as root keys. Each root keys contains a number of subkeys as shown in figure one. A registry key can contain other keys.
    [Show full text]
  • The Windows Registry the Windows Registry
    Windows Registry CSC414 The Computer Windows System Fundamentals Registry Digital Forensics Center Department of Computer Science and Statics THINK BIG WE DO U R I http://www.forensics.cs.uri.edu Windows Registry Registry Hives Hardware & software information Top-level logical grouping of keys - Current and previously attached hardware - User preferences and configuration settings Hive Name Abbreviation Description - Program usage and timestamps Local system hardware, device drivers, services, and machine- HKEY_LOCAL_MACHINE HKLM Logical view specific application data information - Hierarchy of folders (keys) Pre-logon default user profile information for all users on the HKEY_USERS HKU system - Five top level categories (hives) Currently logged on user profile information- link to user key in - Viewed using regedit.exe, regedt32.exe or HKEY_CURRENT_USER HKCU HKU specialized programs AccessData Registry Viewer Link to subkey in HKLM that configuration and file associations for HKEY_CLASS_ROOT HKCR installed software Physical View Link to subkey in HKLM that contains current hardware HKEY_CURRENT_CONFIG HKCC - Actual files containing registry data configuration and some software per-computer application settings - Transaction log of changes Registry Keys Registry Keys Attributes Values - Reference path name - Name Type Name Meaning - Uses \ character for levels - (Default) is default value for the key REG_NONE No Type just raw bytes - Not the file name of a key - Type - Permissions REG_BINARY Binary binary data value - Used to interpret data
    [Show full text]
  • Quest Intrust 11.4.2
    Quest® InTrust 11.4.2 Preparing for Auditing and Monitoring PowerShell Activity © 2020 Quest Software Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission of Quest Software Inc. The information in this document is provided in connection with Quest Software products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest Software products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest Software makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice.
    [Show full text]
  • Constructing a Lightweight Key-Value Store Based on the Windows Native Features
    applied sciences Article Constructing a Lightweight Key-Value Store Based on the Windows Native Features Hyuk-Yoon Kwon Department of Industrial and Systems Engineering and the Research Center for Electrical and Information Technology, Seoul National University of Science and Technology, 232 Gongneung-Ro, Nowon-Gu, Seoul 01811, Korea; [email protected] Received: 22 August 2019; Accepted: 7 September 2019; Published: 11 September 2019 Featured Application: In this paper, we propose a lightweight key-value store for managing various types of data, which are generated from Big data applications, in a very simple form. The proposed technique can be used in any environments where Windows operating systems are running, which encompass from client environments (e.g., Windows 10) to server environments (e.g., Windows Server 2016), with the minimum effort for the installation. For the other environments without Windows operating systems, we can easily migrate data to the other any environments that support existing key-value stores by using the ETL (Extract-Transform-Load) method proposed by this paper. Abstract: In this paper, we propose a method to construct a lightweight key-value store based on the Windows native features. The main idea is providing a thin wrapper for the key-value store on top of a built-in storage in Windows, called Windows registry. First, we define a mapping of the components in the key-value store onto the components in the Windows registry. Then, we present a hash-based multi-level registry index so as to distribute the key-value data balanced and to efficiently access them.
    [Show full text]
  • Mastering Windows XP Registry
    Mastering Windows XP Registry Peter Hipson Associate Publisher: Joel Fugazzotto Acquisitions and Developmental Editor: Ellen L. Dendy Editor: Anamary Ehlen Production Editor: Elizabeth Campbell Technical Editor: Donald Fuller Electronic Publishing Specialist: Maureen Forys, Happenstance Type-O-Rama Proofreaders: Nanette Duffy, Emily Hsuan, Laurie O'Connell, Yariv Rabinovitch, Nancy Riddiough Book Designer: Maureen Forys, Happenstance Type-O-Rama Indexer: Ted Laux Cover Designer: Design Site Cover Illustrator: Sergie Loobkoff Copyright © 2002 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. The author(s) created reusable code in this publication expressly for reuse by readers. Sybex grants readers limited permission to reuse the code found in this publication or its accompanying CD-ROM so long as the author is attributed in any application containing the reusable code and the code itself is never distributed, posted online by electronic transmission, sold, or commercially exploited as a stand-alone product. Aside from this specific exception concerning reusable code, no part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher. First edition copyright © 2000 SYBEX Inc. Library of Congress Card Number: 2002100057 ISBN: 0-7821-2987-0 SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries. Mastering is a trademark of SYBEX Inc. Screen reproductions produced with FullShot 99. FullShot 99 © 1991-1999 Inbit Incorporated. All rights reserved.FullShot is a trademark of Inbit Incorporated.
    [Show full text]
  • 1 Introduction Into WSH
    1 Introduction into WSH This chapter contains a brief introduction into the Windows Script Host (WSH). You will get a first impression of what you can do with this tool, how to install it, and how to use it. What is the Windows Script Host? Windows versions before Windows 98 provided almost nothing to automate certain tasks like backing up files, displaying user dialogs, and maintaining system administration tasks. Many sys- tem administrators and power users requested a tool to support these tasks. NOTE: Of course, you could always use the old MS-DOS batch (BAT-files) file to perform certain tasks like copying files. These BAT-files can be used within a Windows Command Prompt window (the window with the MS-DOS command prompt). However, this approach has several disadvantages like the fact that a BAT-file can only contain a simple sequence of MS-DOS commands (only simple branches and no real looping functionality among other things). Also, dialogs and messages boxes are not supported. In Windows 3.1, you could do a little more with macro recorder to record and play simple keystrokes and mouse clicks; however, the recorder is not available under Windows 9X and Windows NT and does not allow programming. All this led users to seek out third party solutions (like Power Batch) or programming environ- ments like Delphi, Visual Basic, and Visual C to handle these tasks. But these solutions were not acceptable for many Windows users that required a simple and free scripting language to solve their automation tasks. Since Microsoft Office 97 provides Visual Basic for Applications (VBA) and since web authors also know scripting languages like VBScript and JavaScript, it was only a matter of time before Microsoft provided a scripting language for Windows operating systems.
    [Show full text]