Listen to this Post
Pathwiper malware leverages Windows Script Host (WSH) to execute malicious scripts via .BAT and .VBS files. Disabling WSH can prevent such attacks. Below are verified steps and commands to secure your system.
You Should Know:
1. Disabling Windows Script Host via Registry
Open Registry Editor (`regedit`) and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
– Create a DWORD (32-bit) Value named `Enabled`
– Set its Value data to `0`
– Restart the system for changes to take effect.
- Disabling WSH via Group Policy (For Enterprise Systems)
Run `gpedit.msc` and navigate to:
Computer Configuration > Administrative Templates > Windows Components > Windows Script Host
– Enable “Turn off Windows Script Host”
3. Blocking Malicious Script Execution via PowerShell
Use PowerShell to disable script execution:
Set-ExecutionPolicy Restricted -Force
(Prevents PowerShell scripts from running.)
4. Detecting & Removing Pathwiper Malware
Check for suspicious processes:
tasklist /svc | findstr /i "wscript|cscript"
Kill malicious processes:
taskkill /f /im wscript.exe taskkill /f /im cscript.exe
5. Monitoring LSASS Dumping (Prevent Credential Theft)
Enable LSASS protection:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
6. Analyzing Malicious Scripts
Use Windows Defender to scan scripts:
mpcmdrun -scan -scantype 3 -file "C:\suspicious.vbs"
7. Disabling Auto-Run for Scripts
Prevent automatic script execution:
reg add "HKLM\SOFTWARE\Microsoft\Command Processor" /v DisableUNCCheck /t REG_DWORD /d 1 /f
What Undercode Say:
Disabling WSH is critical in preventing script-based malware. Enterprises should enforce Group Policies, monitor LSASS access, and restrict PowerShell execution. Regular system audits and endpoint protection (like Defender ATP) further reduce risks.
Expected Output:
- WSH disabled via Registry/Group Policy.
- PowerShell execution restricted.
- Suspicious scripts blocked and analyzed.
- LSASS dumping prevented.
Prediction:
As malware evolves, attackers will increasingly abuse legitimate Windows features. Microsoft may disable WSH by default in future updates, but admins must stay ahead with proactive hardening.
Relevant URLs:
IT/Security Reporter URL:
Reported By: Charlescrampton Ive – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
