Installing Script Sentry

A general "rule of thumb" regarding security is: "If you aren't using something, disable it." By doing this, you immediately limit your risk, as far as any exploit goes, for that particular service or function. But, sometimes things that have been disabled might get re-enabled by a malicious program, by accident, or by way of an installation or upgrade to some system component...

So, if you really want to limit your exposure, "remove" the service, program or function entirely from your system. Since Windows Scripting Host (WSH) is optional, you can remove it. Here's what Symantec says regarding WSH, which includes information on removing it:

http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html

If you remove WSH, there's no need for Script Sentry. From the installation error posted above, it appears that Script Sentry not only sees that WSH is not installed, but prevents installation of itself because of it. I have not used Script Sentry, but, that error message almost makes it sound like Script Sentry "needs" WSH to operate. Perhaps some of its coding is in VB Script or Javascript, but, I don't know.

If you want to use these scripts on your system, then Script Sentry is probably a very good idea. Also, DCS has something to say on this subject. They provide a patch (the WSH Anti-Polymorphism Patch) to make WSH safer if you are keeping it on your system. I do have this installed...

http://www.diamondcs.com.au/web/patches/enhancer.php3?patch=wsh

One last reminder for everyone as this is often a point of confusion. Script Sentry adds protection for scripts that run locally on your system. It does not add any protection for scripting run within your browser. For example, Javascript run in Internet Explorer... Script Sentry does nothing for you there. Jason is very quick to remind people of this when they start to think his tool protects against internal browser exploits.

Phazor - you'd be safer removing WSH, then keeping it and adding layers of protection to restrict it.

Hope this helps,
LowWaterMark

 

I am still away from home, stuck using only this old Windows 95 200 MHz Pentium system, so I can't check my XP system for some specific details, but, I believe in XP WSH can be removed / restored easily via Add/Remove Program - Windows Components. So, you ought to be able to remove it and put it back if removing it causes any problems. (Check Add/Remove and confirm this is where it is on XP first.)

[hr]11/25 - Edited to clearly strike-out my incorrect advice above. Now that I am home, I find that XP does not have WSH in Add/Remove Programs - Window Components. (Too bad that!!) Therefore, you must follow the advice at the Symantec site and either: 1. run their program to disable the file associations (or do it manually in Folder Options), or 2. remove the program \windows\system32\wscript.exe saving off a copy in case you want to restore it later. Here's the link again:

http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html [hr]
If you remove it, script files on your system won't be executable anymore. For example, this means *.vbs and *.js won't run anymore if you double click them. If you have applications that use these scripting languages, they won't work. I don't think there are any normal, native Microsoft Windows XP based apps that need these for normal operation.

On my XP system, I had already changed the default action on these and some other extensions to be Edit (i.e. Open in Notepad) rather than execute. This was another way to add a simple layer of protection. You do this in Folder Options - by editing the file associations. I also added the DCS patch. I did this rather than uninstalling WSH because I occasionally write and run VBS programs to perform some basic functions.

These scripting languages can be VERY useful, but, if you don't have any scripts (search your system for the various script file extensions), then you aren't really going to miss them. If you need it, leave it and either get a script protection tool or at the least take some steps like I have to restrict them (file assocs and the patch).