wscript.exe and cscript.exe belong to Windows Script Host. They execute certain kinds of scripts and can run legitimately in administrative tasks or installed software.
When activity becomes suspicious
Unexpected execution tied to a USB shortcut, a script in an unusual location or automatic persistence deserves investigation. The Windows process itself can be legitimate while the supplied script is dangerous.
What to inspect in a diagnosis
Consider the command line, invoked file, shortcut origin, execution timing and related indicators such as start.js, profile.js or hidden content. Do not rely on the process name alone.
How the MAYUNDO engine uses this information
ANTÍDOTO V1.6.3 uses these relationships as part of behavioral correlation. In lab scenarios, this combination helped identify associated components and remove relevant persistence.
Immediate precautions
Avoid running scripts just to find out what they do; preserve the scanner report. If activity coincides with unexpected USB changes, investigate both environments.
Related reading
- start.js and profile.js: when these files may be part of MAYUNDO
- MAYUNDO and false positives: why a suspicious filename is not enough
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.