Suspicious file

  Josquius 17:49 09 Jun 2003

I have found a file called cscript.exe in the commands folder of my windows. Its date is out of sync with my other windows folders yet my virus checker identifies it as nothing out of the ordinary. Anyone heard of this?
I do think I have virus trouble at the moment.

  pj123 17:56 09 Jun 2003

Just checked my Command folder and I have cscript.exe as well. Checked with McAfee Virus library, and not listed as a virus. Forget it.

  Josquius 17:58 09 Jun 2003

good, I'm certain I have something somwhere though as I have 2 Rundll32 things on ctrl, alt, del.

I wonder why its date is so out of sync with everything else.

  The Mad Hacker 18:27 09 Jun 2003

It's a script host, written by microsoft. Don't panic about it. I'm not entirely sure what it does, but it's meant to be there.

The date is probably out of sync because it hasn't been upgraded since the days of NT4 or something, I don't know.

  VoG™ 18:31 09 Jun 2003
  Josquius 18:55 09 Jun 2003

and the 2 rundll32 things?

  Dr. Charles 18:59 09 Jun 2003

Yes the Rundle things are meant to be there

  VoG™ 19:00 09 Jun 2003
  woodchip 19:24 09 Jun 2003

Using the command-based script host (CScript.exe)

Cscript.exe is a command-line version of the Windows Script Host that provides command-line options for setting script properties.

With Cscript.exe, you can run scripts by typing the name of a script file at the command prompt. Like Microsoft Internet Explorer, Windows Script Host serves as a controller of Windows Script compliant scripting engines, but Windows Script Host has very low memory requirements. Windows Script Host is ideal for both interactive and non-interactive scripting needs, such as logon scripting and administrative scripting.

Windows Script Host supports scripts written in VBScript or JScript. When you start a script from your desktop or from the command prompt, the script host reads and passes the specified script file contents to the registered script engine. The script engine uses file extensions (that is, .vbs for VBScript and .js for JScript) to identify the script. As a result, you do not need to know the exact programmatic identifier (that is, the ProgID) of the script engine. The script host maintains a mapping of script extensions to programmatic identifiers, and uses the Windows XP association model to start the appropriate engine for a given script. For more information about Windows Script Host, see Windows Script Host For more information about CScript.exe, see To run scripts using the command-line-based script host (cscript.exe)

  Josquius 19:47 09 Jun 2003

I did have a virus though it wasn't that.
I used a online virus scanner and it turned out I had 2 files with W32.IRCBot.Gen which I deleted then after further scans totally erased from the recycle bin.
Anyway that was all it found and I think I should be clean. I'm keeping my little sister well away from kazaa in the future.

  Brian-336451 19:47 09 Jun 2003

You are either a very knowledgable chap or someone with FAR too much time on their hands (perhaps BOTH).

I must admit I select your 'click here's just to learn what you've been delving into THIS time. In the process the internal knowledge-base improves accordingly.

Keep up the good work!!

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

AMD Radeon Adrenalin release date, new features, compatible graphics cards

Inside the iMac Pro - Apple's most powerful Mac yet

iMac Pro release date, UK price & specs

Football : comment regarder la Ligue 1 en direct ?