wscript.exe

[granjan]

For about a week now I am constantly getting a popup from Sygate
firewall:
Microsoft Windows Based Script Host (wscript.exe) is trying to
connect to csc3-2004-crl.verisign.com(12.158.80.10) using remote
port 80 (HTTP - World Wide Web). Do you want to allow this program
to access the network?

A Google search sent me to some sites that said it might be a worm.
I don't know if I should allow access or not.

Windows XP MCE
IE7 recently downloaded (could this be the problem). I also
recently downloaded WMP11.

Any ideas?
Thanks, Janice

 

[Poprivet]

For about a week now I am constantly getting a popup from Sygate
firewall:
Microsoft Windows Based Script Host (wscript.exe) is trying to
connect to csc3-2004-crl.verisign.com(12.158.80.10) using remote
port 80 (HTTP - World Wide Web). Do you want to allow this program
to access the network?

A Google search sent me to some sites that said it might be a worm.
I don't know if I should allow access or not.

Windows XP MCE
IE7 recently downloaded (could this be the problem). I also
recently downloaded WMP11.

Any ideas?
Thanks, Janice

Well; if you don't know what it is, don't need it or recognize it, deny it.
I suspect it's WMP, but if you dont' care, deny it. If everything keeps
working, then eventually deny it and tell it not to ask again.

Wouldn't hurt to run your AV and malware scanners after updating them
either.

Pop`

 

[Ramesh, MS-MVP]

Janice,

You may use Process Explorer to see the full command-line of the wscript.exe process. That way you can determine the name of the scripting file being run.

Process Explorer for Windows v10.21:
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows XP Shell/User]
Windows® XP Troubleshooting http://www.winhelponline.com


For about a week now I am constantly getting a popup from Sygate
firewall:
Microsoft Windows Based Script Host (wscript.exe) is trying to
connect to csc3-2004-crl.verisign.com(12.158.80.10) using remote
port 80 (HTTP - World Wide Web). Do you want to allow this program
to access the network?

A Google search sent me to some sites that said it might be a worm.
I don't know if I should allow access or not.

Windows XP MCE
IE7 recently downloaded (could this be the problem). I also
recently downloaded WMP11.

Any ideas?
Thanks, Janice