1

A few days ago I first noticed that one of my VBscripts just stopped by itself, a few seconds after starting. Turns out that the wscript.exe process gets killed off about 5 seconds after it is created. This is pretty exact. I wrote a test script with:

wscript.sleep 4800
wscript.echo "hi"

I see the wscript.exe process in TaskManager, I will see the message box for a split second after waiting 4.8 sec. and then it (and the process) disappears. Changing the time to 5200 and I will never see a message box.
And here the strange thing: setting the time to 5000, the process will also be killed most of the time, but I've witnessed 3 times that is was not killed. The process would not disappear until I clicked OK.

  • Same behavior for wscript.exe and cscript.exe

  • Double clicking the vbs from Explorer, or running the vbs from a administrator-started cmd.exe makes no difference

  • I'm using Security Essentials (and have for a long time)

  • HijackThis shows this line (that has not always been there): O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (mbamgui.exe is not a running process though)

  • When run with cscript output is:

d:\temp>cscript tst.vbs
Microsoft (R) Windows Script Host Version 5.8
Copyright (C) Microsoft Corporation. All rights reserved.

hi
Script execution time was exceeded on script "d:\temp\tst.vbs".
Script execution was terminated.

The code below also only shows a result if the calculation time is kept below 5 seconds:

t1=Timer
For i=1 to 25000000
x = Rnd()*Rnd()
Next
MsgBox timer-t1

On my machine, with 25000000 I see the result a split second, with 30000000 the result is never shown.

Is there any way to pinpoint which process is responsible for killing my VBscript process?

1

The timeout default is none, so maybe you've accidentally configured a timeout for the script engine.

If that's not the issue, than you can try to monitor the scripting process (either WScript or CScript) using Sysinternals ProcMon.

  • there is a command line option //S which will "set the current command line options for the user". I have not tested this but it implies that if run at the same time as the //T (timeout) option, it will store the T option as a default – horatio Dec 17 '13 at 22:07
  • Yes, that was it. I've just tested //T with //S and it is stored in the Timeout REG-DWORD under [HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings]. I have it fact been playing around with these //options not so long ago.... – mgr326639 Dec 17 '13 at 22:15
  • The mystery of the thing I witnessed three times remains though.... – mgr326639 Dec 17 '13 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.