# wscript.exe

Windows Process: Microsoft Corporation

Catalog search terms wscript, windows script host, wsh gui

Windows, System Component

Windows Script Host GUI host. E dey run .vbs and .js with dialogs and no console window. cscript.exe na the console host. powershell.exe na PowerShell.

## Wetin you need know

wscript na GUI WSH, no be cscript and no be powershell.

wscript.exe na Windows Script Host with GUI. .vbs and .js files wey dem double-click often dey start here. cscript.exe dey write to console. powershell.exe na different language host.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **Same as cscript?**: No. cscript na the console host

  **Same as PowerShell?**: No

Feex tok say

If .vbs pop up box and the name na wscript, I dey read the script path. I no dey end powershell.exe for dat dialog, and I no dey treat cscript as the same window.

## Wetin be wscript.exe?

wscript.exe na GUI Windows Script Host. E no be cscript.exe and e no be powershell.exe. The file na System32\wscript.exe.

## Wetin e dey do?

E dey load script and fit show MsgBox-style UI. cscript.exe dey print to stdout instead. PowerShell no dey use this host.

## Wetin make am dey run?

You double-click .vbs or .js, logon script call wscript, or installer still dey use WSH. wscript wey remain with strange script path need make you check the path.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'wscript.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check the script path

System32 wscript.exe na Microsoft. The script wey e launch na the risk. wscript.exe inside Temp no be WSH.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\Windows\System32\wscript.exe`

- GUI WSH host
- Console sibling: cscript.exe
- No be powershell.exe

## I fit end am?

E dey stop that script

To end wscript.exe dey kill the running script and im dialogs. cscript.exe and powershell.exe fit stay.

## I fit comot am?

No

No delete wscript.exe. Change file associations or use AppLocker / WDAC if you need to block scripts. Na policy be dat, no be Explorer.

## E suppose start with Windows?

Script or Run key fit start am. E no suppose be permanent tray app.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | wscript.exe                                                                        |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\Windows\System32\wscript.exe                                                    |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Common wahala dem

### Email .vbs dey open wscript

Na WSH dey run the attachment be dat. End this process, then quarantine the script. E no be PowerShell by default.

### People dey disable PowerShell to stop VBS

Wrong host. .vbs na wscript or cscript unless person wrap am.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Read the command line for the .vbs or .js path

Dat file na the question. wscript.exe na just the host.

### No replace wscript from "WSH fix" zip

Na Servicing get System32.

## Technical details

Technical details

| Image name | wscript.exe             |
| ---------- | ----------------------- |
| Role       | Windows Script Host GUI |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[cscript.exe: Windows Process](https://feex.it/wiki/l/pcm/process/cscript.exe/)[powershell.exe: Application Process](https://feex.it/wiki/l/pcm/process/powershell.exe/)[cmd.exe: Application Process](https://feex.it/wiki/l/pcm/process/cmd.exe/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Windows processes: Category](https://feex.it/wiki/process/windows/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: wscript ](https://learn.microsoft.com/windows-server/administration/windows-commands/wscript)· GUI Windows Script Host
- [Microsoft Learn: Windows Script Host ](https://learn.microsoft.com/windows/win32/lwef/windows-script-host)· WSH dey host .vbs and .js
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: wscript.exe

  **Typical path**: C:\Windows\System32\wscript.exe

  **Record context**: Feex Wiki reference entry

  **Related process**: [cscript.exe](https://feex.it/wiki/l/pcm/process/cscript.exe/)

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/wscript.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)