ePO VSE 8.8 scriptscan

[ms0261198]

Hi there,

how can i enter a script exclusion in VSE 8.8 that is called as follows

" c:\windows\wscript.exe c:\Programme\name.vbs " 

execution is currently blocked.

[LeeHarvey]

Are you certain that McAfee VSE 8.8 ScriptScan is involved?  In my experience, ScriptScan will either quarantine/delete malicious scripts, or warn about poorly performing scripts allowing users to manually terminate them.  Also, depending upon VSE 8.8 logging and alerting options, users or administrators should get notified about ScriptScan detections.

The fact that execution is currently blocked sounds more like a Windows system policy, software restriction policy, or some other third-party security software -- all of which are controlled by Windows system administrators.

Some things to check:

1. Is wscript.exe really in your C:\Windows folder?  Typically, it's found in C:\Windows\system32 or C:\Windows\SysWOW64 folders for 64-bit and 32-bit execution, respectively.
2. Is your .vbs script digitally code-signed by a trusted publisher? If not, try signing it.
3. Have you checked your Windows Event Log? Sometimes execution blocks get logged in the Application, Security, or System event logs, and may include the source and reason.
4. Have you tried excluding your c:\Programme\name.vbs in VirusScan Enterprise 8.8 ScriptScan exclusions?  If your system supports legacy 8.3 filenames, then you may need to exclude C:\PROGRA~3\name.vbs as well -- assuming "C:\Program Files" and "C:\Program Files (x86)" folders also exist.

If your VSE 8.8 configuration is controlled by McAfee ePolicy Orchestrator (ePO), then your ePO administrator will need to configure the ScriptScan exclusion mentioned in (d) above.

Hope this info helps.