« previous next »
Pages: [1]   Go Down

Author Topic: wscript.exe ?  (Read 707 times)

0 Members and 1 Guest are viewing this topic.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
wscript.exe ?
« on: December 28, 2011, 10:03:49 PM »
Win Patrol says wscript.exe   

Microsoft (R) Windows Script Host  wishes to run once on next startup.

It says it resides here:

B C::\Documents and Setting\MYNAME\Local Settings\Applicaiton Data\
version 5.7.18066


Is this legit?  Should I let it run?

There's also something that seems new  in the startup list on Win Patrol called:
bundleff   
run.ff.js
Microsoft Corporation
RunOnce
5/11/2011  (first detected)
Logged

Offline winchester73

  • Administrator
  • Hero Member
  • *****
  • Posts: 5124
  • Half a bubble off plumb
Re: wscript.exe ?
« Reply #1 on: December 29, 2011, 01:34:14 PM »
Windows Script:  http://support.microsoft.com/kb/952830

I don't use Firefox, but I think the other is an add-on for it.  Wait for a FF user to comment further ...
Logged
Speak softly, but carry a big Winchester ... Winchester Arms Collectors Association member


Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Re: wscript.exe ?
« Reply #2 on: December 29, 2011, 05:52:18 PM »
I denied it, just in case my computer gets restarted.  If it's determined to be ok, I assume I can let WinPatrol let it through.
Logged

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Re: wscript.exe ?
« Reply #3 on: February 25, 2012, 10:37:07 PM »
This program has popped up and asked to be installed as a Start up again . .  Here is the WinPatrol screen:


I just need to know whether to allow it or not.   I've been having some issues with installed fonts displaying in a corrupted state (jagged and broken text)...could this be a program related to that?

Logged

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11538
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: wscript.exe ?
« Reply #4 on: February 26, 2012, 12:37:17 AM »
/B = Batch mode; suppresses command-line display of user prompts and script errors. Default is Interactive mode.

What information follows Application Data\ in the WinPatrol alert?  If necessary, increase the size of the window by positioning your mouse n the corner until it becomes an arrow and drag to enlarge.

Do you have the Execute JS Firefox Add-on installed or any of the associated add-ons listed in the "Often used with…" or "Part of these Collections" section of the page?
Logged
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Re: wscript.exe ?
« Reply #5 on: February 26, 2012, 02:09:44 AM »
Sorry, the WinPatrol alert will not expand in any direction.

Here is a screen shot of my startup menu from WinPatrol:
http://z2.ifrm.com/10717/129/0/p1032925/zzwinpatrolstart.png

maybe that could tell you something. Its showing it as the bundleff  entry, I think.

I do have a couple extensions in the down list of the developer tools:  FireBug, Colorzilla and I  thinkStylish has expired with one of the FF updates.  o I see the list in my signature needs updated...will so that right now.
Logged

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Re: wscript.exe ?
« Reply #6 on: February 26, 2012, 02:29:05 AM »
ok.   extension and plugin list is updated now....and I see I forgot to mention that I don't have the Execute JS extention.

I tried to search google to see if that file is supposed to reside in Application Data, but I was unsuccessful in finding out anything about where it is supposed to be.
Logged

Offline Corrine

  • The Mystical Rose
  • Administrator
  • Hero Member
  • *****
  • Posts: 11538
  • "Stronger than the past, united in our goal."
    • Security Garden
Re: wscript.exe ?
« Reply #7 on: February 26, 2012, 02:45:14 AM »
Well, the only search results I come up with when searching bundleff + "run.ff.js" is your thread.  Without knowing what bundleff is, I wouldn't want to run that batch file.
Logged
,  

Take a walk through the "Security Garden" -- Where Everything is Coming up Roses!

Remember - A day without laughter is a day wasted.
May the wind sing to you and the sun rise in your heart.

Offline pastywhitegurl

  • Sr. Member
  • ****
  • Posts: 394
  • advanced techno feeb
Re: wscript.exe ?
« Reply #8 on: February 26, 2012, 02:49:58 AM »
From looking at the first part of my thread it seems to be the same program trying to run again.  I guess I will just block it again.

From what I've read, it is a legitimate MicroSoft program that malware uses to deliver their payloads through flash drives and other script running applications.  So unless something tells me it needs that it seems like I should just keep blocking it.  The WinPatrol asks if its something "expected and acceptable".  Well, it doesn't qualify on the first one, and I have no idea about the second.

Thanks, Corrine.  I'll keep watching this thread for a while in case something else occurs to you.
Logged
Pages: [1]   Go Up
« previous next »