So I know what this Microsoft console based script host is, but my question is why does it think it has to connect to the intenet every once in a while?
Only very recently started getting it to trigger an alert via my firewall. I have even gone so far as to add the registry edit to disable it, but still get the alert.
Microsoft ® Console Based Script Host (part of Microsoft ® Windows Script Host) © Microsoft Corporation Information about Microsoft ® Console Based Script Host
Microsoft ® Console Based Script Host is usually found in following folders:
Best Answer Max Norris , 15 March 2014 - 12:38
I am absolutely positive I have the registry edit set correctly
How did you run that command from the desktop?
Just create a blank text file and rename it to whatever.vbs and double click it, that'll launch via wscript, doesn't need to have any actual script code in it, blank is fine. (Or do "wscript whatever.vbs" in a console, same thing.) If you want to get cute, you can put a MsgBox("I'm still active") in it, just to prove to yourself it's running or not. But yea, if it's still somehow starting, trap the sucker with ProcMon and see where it's coming from. If it's not starting automatically from any number of sources, AutoRuns won't help you, like I said any program can start a script if it wanted to, pretty easy to integrate scripting into an application. Disabling the script engine is just a bandaid (never mind potentially breaking other applications that may need it), you'll want to find out what's running it in the first place, hence ProcMon.Go to the full post