1

A few days ago I first noticed that one of my VBscripts just stopped by itself, a few seconds after starting. Turns out that the wscript.exe process gets killed off about 5 seconds after it is created. This is pretty exact. I wrote a test script with:

wscript.sleep 4800
wscript.echo "hi"

I see the wscript.exe process in TaskManager, I will see the message box for a split second after waiting 4.8 sec. and then it (and the process) disappears. Changing the time to 5200 and I will never see a message box.
And here the strange thing: setting the time to 5000, the process will also be killed most of the time, but I've witnessed 3 times that is was not killed. The process would not disappear until I clicked OK.

  • Same behavior for wscript.exe and cscript.exe

  • Double clicking the vbs from Explorer, or running the vbs from a administrator-started cmd.exe makes no difference

  • I'm using Security Essentials (and have for a long time)

  • HijackThis shows this line (that has not always been there): O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (mbamgui.exe is not a running process though)

  • When run with cscript output is:

d:\temp>cscript tst.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

hi
Script execution time was exceeded on script "d:\temp\tst.vbs".
Script execution was terminated.

The code below also only shows a result if the calculation time is kept below 5 seconds:

t1=Timer
For i=1 to 25000000
x = Rnd()*Rnd()
Next
MsgBox timer-t1

On my machine, with 25000000 I see the result a split second, with 30000000 the result is never shown.

Is there any way to pinpoint which process is responsible for killing my VBscript process?

1 Answer 1

1

The timeout default is none, so maybe you've accidentally configured a timeout for the script engine.

If that's not the issue, than you can try to monitor the scripting process (either WScript or CScript) using Sysinternals ProcMon.

3
  • there is a command line option //S which will "set the current command line options for the user". I have not tested this but it implies that if run at the same time as the //T (timeout) option, it will store the T option as a default
    – horatio
    Dec 17, 2013 at 22:07
  • Yes, that was it. I've just tested //T with //S and it is stored in the Timeout REG-DWORD under [HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]. I have it fact been playing around with these //options not so long ago....
    – mgr326639
    Dec 17, 2013 at 22:15
  • The mystery of the thing I witnessed three times remains though....
    – mgr326639
    Dec 17, 2013 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .