*************************************** ** ** ** Windows Script (Host) Uninstaller ** ** ** *************************************** ------------ - Contents - ------------ * Introduction * Compatibility - Windows - Windows Script (Host) * Installation - Install - Pre-Requisites - Required Files * Using WSH-UN.BAT - Running WSH-UN.BAT - Checking the Results * Summary of Windows Script Uninstallation - Unregistering DLL's & OCX's - Deleting Files - Removing Extensions & Registered File Types - Cleaning Up Misc. Registry Entries * Want Windows Script (Host) Back? * Troubleshooting * How This Utility Was Created * Fun Stuff - Editing the .BAT File - Editing .REG Files * More Information * Problems & Questions ---------------- - End Contents - ---------------- ============ Introduction ============ Microsoft Windows Script (WS), sometimes known as the Windows Scripting Host (or "Visual Basic Scripting"), is a set of powerful scripting tools that can, in certain circumstances, be used by malicious parties to spread viruses and worms and do damage to computers. While these scripting tools can prove incredibly useful for programmers, power users, and system administrators, many folks have little or no need to keep Windows Script (Host) on their systems, especially in light of the malicious ends to which these tools can put. One of the nicer aspects of Windows 98 and Windows 98SE is that the "Windows Scripting Host" appears as a setup option, allowing users who do not use applications or web sites which require these scripting tools to uninstall Windows Script (Host) in order to prevent both the spread of viruses and worms on their systems as well as the damage they can do. To access this setup option in Windows 98 & 98SE: - Open "Control Panel" - Open "Add/Remove Programs" - Click the "Windows Setup" tab - Click "Accessories" and hit the "Details" button - Check or uncheck "Windows Scripting Host" to install or uninstall - Click "OK" to save for your changes Unfortunately, this setup option is not available if you... * are running any other version of Windows -- Windows Script (Host) is installed by default on Windows ME and Windows 2000 but is not available in "Windows Setup"; * download and install a Windows Script installation package from microsoft.com (e.g., Windows Script 5.1 or 5.5) -- these later versions are not listed in "Add/Remove Programs" and do not ship with an uninstaller; * pick up Windows Script (Host) from Internet Explorer 5.0 or above -- it appears as installation item named "Visual Basic Scripting Support," but there is no ready means to uninstall this package. In each of the above cases, users have no visible or readily available means to uninstall Windows Script (Host) should they so desire. This Windows Script (Host) Uninstaller allows users who aren't running Windows 98 or Windows 98SE to uninstall any version Windows Script (Host), no matter the original source of the installation. Other Solutions ~~~~~~~~~~~~~~~ Please keep in mind that uninstalling Windows Script (Host) is NOT the only solution available to those who are concerned about the risks of having Windows Script on their computers. For links to info and utilities which allow you to keep Windows Script (Host) installed (but effectively "de-fanged"), see the "More Information" section towards the end of this document. ============= Compatibility ============= While this Windows Script (Host) Uninstaller will work on many systems, unfortunately, it will not work on ALL systems. ------- Windows ------- This batch file can uninstall Windows Script (Host) from the following versions of Windows... * Windows 98 SE ##[see note below] * Windows 98 (original or SR1) ##[see note below] * Windows 95 (any version) * Windows NT 4.0 (any service pack level) This batch file will NOT uninstall Windows Script (Host) from Windows ME or Windows 2000 due to the System File Protection scheme that these versions of Windows employ. WSH-UN.BAT is written to check for the existence of Windows Me. To confirm the existence of Windows Me, this utility checks for the following files: %WINDIR%\SYSTEM\SFP\SFPDB.SFP %WINDIR%\SYSTEM\SFP\SFPLOG.TXT If either of these files is found, the uninstaller will notify the user that it does not work on Windows ME and then exit. WSH-UN.BAT is also written to check for the existence of Windows 2000. To confirm the existence of Windows 2000, WSH-UN.BAT checks for the following files and folders: %WINDIR%\SYSTEM32\DLLCACHE %WINDIR%\SYSTEM32\RPCSS.DLL If either of these files or folders is found, the uninstall utility will notify the user that it does not work on Windows 2000 and then exit. ## A Note About This Uninstaller & Windows 98 & 98SE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Although Windows 98 and Windows 98SE both contain a setup option enabling the "Windows Scripting Host" to be uninstalled, there are circumstances in which Windows 98 & 98SE users may still find this utility useful. - if Windows 98 users install later versions of Windows Script (e.g., 5.1 & later, or "Visual Basic Scripting Support from IE 5), the native "Windows Setup" option, while still still available, will not completely remove all WS Extensions, File Types, and other related Registry entries. - if Windows 98 users uninstall "Windows Scripting Host" using "Windows Setup" and then pick up a later version of Windows Script (Host), "Windows Setup" will still show "Windows Script- ing" as uninstalled, leaving the user no clear way to uninstall Windows Script (Host). This Windows Script (Host) Uninstaller is a more complete solution. It can completely uninstall not only the "Windows Scripting Host" that ships with Windows 98, but any later versions of Windows Script that the user might acquire. In fact, when used on Windows 98 this uninstall utility will even configure "Windows Setup" to recognize that "Windows Scripting Host" has been uninstalled. --------------------- Windows Script (Host) --------------------- This batch file utility will uninstall any version of Windows Script, sometimes known as the Windows Scripting Host. It will uninstall Windows Script (Host) no matter the original source of the installation... * Windows Script 5.6 (from microsoft.com) * Windows Script 5.5 (from microsoft.com) * Windows Script 5.1 (from microsoft.com) * Windows Script 5.0 (from microsoft.com) * Visual Basic Scripting Support (any version of Internet Explorer 5) * Windows Scripting Host 2.0 beta * Windows Scripting Host 1.0 (Windows 98 SE) * Windows Scripting Host 1.0 (Windows 98) * Windows Scripting Host 1.0 As noted before, when used on Windows 98 or Windows 98SE, the Windows Script (Host) Uninstaller will configure "Windows Setup" to recognize that "Windows Scripting Host" has been uninstalled. ============ Installation ============ ------- Install ------- Installation of the Windows Script (Host) Uninstaller is simple. After unpacking all the files from WSH-UN.EXE or WSH-UN.ZIP to a unique, common directory (default is C:\WSH-UN), make a shortcut on your desktop or Start menu to WSH-UN.BAT (set the "Start in:" to C:\WSH- UN or wherever it's installed), and run it. -------------- Pre-Requisites -------------- The Windows Script (Host) Uninstaller makes use of CHOICE.COM, a DOS utility which shipped with every version of MS DOS 6.0 and above, as well as with all versions of Win 9x, including Windows 95, Windows 98 (original), and Windows 98 SE. Windows NT 4.0 does not, however, include a copy of this file. This distribution includes a copy of CHOICE.COM (from Windows 95B - OSR2) for Windows NT 4.0 users. Before using WSH-UN.BAT, you should move or copy CHOICE.COM to some location on your "Path" -- good choices for locating CHOICE.COM are \WINNT or \WINNT\SYSTEM32. -------------- Required Files -------------- To remove Windows Script (Host) from your PC, the Windows Script (Host) Uninstaller requires that the files supplied with this distribution be located in the same directory as WSH-UN.BAT. Those files are: ReadMe.txt (required for "View ReadMe" option) un-ext.reg un-misc.reg un-wshom.reg win98-un.reg ws56-un.reg If WSH-UN.BAT cannot find these files when it runs, it will notify you that one or more files is missing and then exit. A Word of Caution... ~~~~~~~~~~~~~~~~~~~~ Please note that most of these files are .REG files, Windows Registry files. Please do not try to use any of these files outside of WSH-UN.BAT. This batch file was written to use the appropriate files at the right time for your version of Windows. Double-clicking on any of them will *instantly* "merge" them into your Windows Registry. If you double-click on the wrong .REG file, you could make unpredictable or even damaging changes to your Windows Registry. ============ Using WSH-UN ============ ------------------ Running WSH-UN.BAT ------------------ To run the Windows Script (Host) Uninstaller, simply double-click on WSH-UN.BAT or the shortcut that you created to WSH-UN.BAT (see above for more information on installing the Windows Script (Host) Uninstaller). When you run WSH-UN.BAT, you will be presented with the following menu: This program will uninstall Windows Script (Host) from your PC. Do you want to uninstall Windows Script (Host)? [1] YES - uninstall WSH [2] NO - exit this program (3) More INFO, Please! (4) View the README.TXT These options are fairly self-explanatory. If you aren't sure that you want to uninstall the Windows Script (Host) from your PC, don't choose option # 1; choose # 3 or # 4 to read more about uninstalling Windows Script (Host) or # 2 to exit the uninstaller. -------------------- Checking the Results -------------------- Included with this Windows Script (Host) uninstaller is a harmless little VBS (Visual Basic Script) "test" applet named TEST.VBS. If Windows Script is installed and enabled, the TEST.VBS will generate a two successive dialog boxes with the following messages: "If this were a virus, something bad might happen now." "But you can use the Windows Script (Host) Uninstaller to short-circuit this VBScript." If Windows Script is uninstalled, running TEST.VBS should open the "Open With..." dialog box, asking you to choose program with which to open. Optionally, you could also manually check for the existence of Windows Script files or Registry entries to confirm that Windows Script (Host) has in fact been uninstalled. For a list of these files and Registry entries, see the next section, below. ======================================== Summary of Windows Script Uninstallation ======================================== Uninstallation of Windows Script (Host) involves a series of steps in which various Registry keys and files are removed from the system. What follows below is a short summary of the files and Registry keys that are removed. --------------------------- Unregistering DLL's & OCX's --------------------------- First, DLL's and OCX's are "unregistered." To unregister DLL's, REGSVR32.EXE is called. OCX's are unregistered by removing entries from the Registry. If Windows Script 5.6 is detected, WSCRIPT.EXE is prompted to remove entries peculiar to WS 5.6. ~~~~~~~~~~~~~~~~ Unregister DLL's ~~~~~~~~~~~~~~~~ PROPER NAME 9x Location NT 4.0 Location Note ----------- ----------- --------------- ---- scrrun.dll \WINDOWS\SYSTEM \WINNT\SYSTEM32 wshcon.dll n/a \WINNT\SYSTEM32 WS 5.6, NT 4.0 only wshext.dll \WINDOWS\SYSTEM \WINNT\SYSTEM32 wshom.ocx \WINDOWS\SYSTEM \WINNT\SYSTEM32 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Unregister WSHOM.OCX (all versions except WS 5.6) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PROPER NAME 9x Location NT 4.0 Location ----------- ----------- --------------- wshom.ocx \WINDOWS\SYSTEM \WINNT\SYSTEM32 Registry Keys ------------- HKCR\CLSID\{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B} HKCR\CLSID\{F935DC26-1CF0-11D0-ADB9-00C04FD58A0B} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Unregister WSHOM.OCX (all versions) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PROPER NAME 9x Location NT 4.0 Location ----------- ----------- --------------- wshom.ocx \WINDOWS\SYSTEM \WINNT\SYSTEM32 Registry Keys ------------- HKCR\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B} HKCR\WScript.Network HKCR\WScript.Network.1 HKCR\WScript.Shell HKCR\WScript.Shell.1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Unregister WSHOM.OCX (WS 5.6 only) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PROPER NAME 9x Location NT 4.0 Location ----------- ----------- --------------- wshom.ocx \WINDOWS\SYSTEM \WINNT\SYSTEM32 Registry Keys ------------- HKCR\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} HKCR\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74} HKCR\Interface\{53BAD8C1-E718-11CF-893D-00A0C9054228} HKCR\Interface\{41904400-BE18-11D3-A28B-00104BD35090} HKCR\Interface\{08FED190-BE19-11D3-A28B-00104BD35090} HKCR\Interface\{0AB5A3D0-E5B6-11D0-ABF5-00A0C90FFFC0} HKCR\Interface\{C7C3F5A1-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{C7C3F5A0-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{C7C3F5A2-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{C7C3F5A3-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{C7C3F5A5-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{C7C3F5A4-88A3-11D0-ABCB-00A0C90FFFC0} HKCR\Interface\{2A0B9D10-4B87-11D3-A97A-00104B365C9F} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Unregister WSCRIPT.EXE (WS 5.6, NT 4.0 only) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ PROPER NAME NT 4.0 Location ----------- --------------- wscript.exe \WINNT\SYSTEM32 Registry Keys ------------- HKCR\CLSID\{6F201542-B482-11D2-A250-00104BD35090} HKCR\Interface\{8A9EA2C0-D348-11D2-A253-00104BD35090} HKCR\Interface\{6F201541-B482-11D2-A250-00104BD35090} HKCR\Interface\{83EA33C0-CD14-11D2-A252-00104BD35090} HKCR\TypeLib\{6F201540-B482-11D2-A250-00104BD35090} HKCR\WSHRemote -------------- Deleting Files -------------- Next Windows Script files are removed. ~~~~~~~~~~~~~~ Standard Files ~~~~~~~~~~~~~~ PROPER NAME 9x Location NT 4.0 Location Note ----------- ----------- --------------- ---- cscript.exe \WINDOWS\COMMAND \WINNT\SYSTEM32 wscript.exe \WINDOWS \WINNT\SYSTEM32 scrrun.dll \WINDOWS\SYSTEM \WINNT\SYSTEM32 wshcon.dll n/a \WINNT\SYSTEM32 WS 5.6 only wshext.dll \WINDOWS\SYSTEM \WINNT\SYSTEM32 wshom.ocx \WINDOWS\SYSTEM \WINNT\SYSTEM32 ~~~~~~~~~~~~~~~~ Help & INF Files ~~~~~~~~~~~~~~~~ PROPER NAME Location (9x & NT) Note ----------- ------------------ ---- wscript.hlp %WINDIR%\Help wscript.gid %WINDIR%\Help wscript.cnt %WINDIR%\Help scr56en.inf %WINDIR%\Inf WS 5.6 setup scr55en.inf %WINDIR%\Inf WS 5.5 setup ste51en.inf %WINDIR%\Inf WS 5.1 setup ste50en.inf %WINDIR%\Inf WS 5.0 setup unie5bak.inf %WINDIR%\Inf IE 5 VBScript setup vbscript.inf %WINDIR%\Inf IE 5 VBScript setup wsh20en.inf %WINDIR%\Inf WSH 2.0 (beta) wsh.inf %WINDIR%\Inf WSH 1.0 & Win98 -- NOT uninstalled b/c Win98 may need for Windows Setup ~~~~~~~ Samples ~~~~~~~ PROPER NAME Location (9x & NT) Note ----------- ------------------ ---- *.js %WINDIR%\Samples\WSH multiple files w/ .js extension *.vbs %WINDIR%\Samples\WSH multiple files w/ .vbs extension *.xls %WINDIR%\Samples\WSH multiple files w/ .xls extension *.ws %WINDIR%\Samples\WSH multiple files w/ .ws extension \Samples\WSH %WINDIR% remove the entire directory ------------------------------------------- Removing Extensions & Registered File Types ------------------------------------------- Now, Windows Script Extensions and File Types are removed from HKEY_CLASSES_ROOT in the Registry. ---------- --------- --------- ---- Registered Extension File Type Note File Type (HKCR\) (HKCR\) ---------- --------- --------- ---- JScript File .JS JSFile JScript Encoded .JSE JSEFile not in WSH 1.0/Win98 File VBScript Encoded .VBE VBEFile not in WSH 1.0/Win98 File VBScript File .VBS VBSFile Windows Script .WSF WSFFile not in WSH 1.0/Win98 File Windows Script .WSH WSHFile Host Settings File ---------------------------------- Cleaning Up Misc. Registry Entries ---------------------------------- Finally, a number of misc. Registry entries are removed (or, in two cases configured properly). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Active Setup Installed Components ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\... Installed Components Key Note ------------------------ ---- {4f645220-306d-11d2-995d-00c04f98bbc9} WS 5.6, 5.5, IE 5.5, IE 5.5 SP1 {2C2738E0-8E3A-11d3-A998-00104B365C9F} WS 5.1 {2C2738E1-8E3A-11d3-A998-00104B365C9F} WS 5.1 {0E8AF1C0-D275-11d2-B803-0000F81E8383} WS 5.1, WS 5.0 {10ABA7E0-3236-11d2-B7B0-0000F81E8383} WS 5.1, WS 5.0 {0E8AF1C1-D275-11d2-B803-0000F81E8383} WS 5.1, WS 5.0 {10ABA7E1-3236-11d2-B7B0-0000F81E8383} WS 5.1, WS 5.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Approved Shell Extensions (all versions) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Uninstall Key (all IE 5 versions) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Uninstall Key (early WSH versions) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsScriptingHost ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Uninstall Key (WSH 2.0 beta) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsScriptHost ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Software Key (Win98 WSH only) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKCU\SOFTWARE\Microsoft\Windows Scripting Host HKLM\SOFTWARE\Microsoft\Windows Scripting Host ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Software Key (all versions) ~~~~~~~~~~~~~~~~~~~~~~~~~~~ HKCU\SOFTWARE\Microsoft\Windows Script Host HKLM\SOFTWARE\Microsoft\Windows Script Host ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Set Win98 WSH To "Not Installed" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Setup\OptionalComponents\WSH] "Installed"="0" ================================ Want Windows Script (Host) Back? ================================ If you later decide that you would like to reinstall Windows Script (Host), you can download the latest version of Windows Script (Host) from: http://msdn.microsoft.com/scripting/ =============== Troubleshooting =============== Although you shouldn't encounter any problems with this batch file utility, several errors could crop up. REGEDIT Errors ~~~~~~~~~~~~~~ If you receive an error indicating that a .REG file could not be merged into the Registry, the most likely culprits are: - a missing or damaged REGEDIT.EXE (which should be somewhere in your Windows folder) - incorrect file association information for the .REG file type (in other words, Windows doesn't know what to do with .REG files) If you receive an error while attempting to merge the appropriate .REG file into the Registry, you should consult the online Windows Help, correct the problem, and try again. Environment Space (Windows 9x) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If this uninstall utility appears to conk out with errors (esp. syntax errors) and you are running Windows 9x (95, 98, or 98SE), then you can try adjusting the "command environment space" by adding something like the following line either to your CONFIG.SYS or to the custom CONFIG.SYS for your MS-DOS shortcut to WSH-UN.BAT (see the "Properties" for the MS- DOS shortcut): SHELL=\COMMAND.COM /p /e:1024 ...where is the complete path to your COMMAND.COM. The /e:xxxx switch sets the environment space in bytes. You may only need /e:512. ============================ How This Utility Was Created ============================ In order to gather setup and configuration information for the various different versions of Windows Script (Host) that have been released by Microsoft over the past several years, I used several tools and methods: - manual inspection of .INF setup files in Windows Notepad - manual inspection of and searches for keys and values in REGEDIT.EXE - RegMon - a free utility that captures and logs Registry reads and writes (available from http://www.sysinternals.com/) - InCtrl5 - a free utility which monitors and logs application installations (available from http://www.zdnet.com/downloads/ stories/info/0,,001CV2,.html) - WinZip 8.0 - a shareware archive utility which can unpack and peek inside of Microsoft .CAB and self-extracting/installing .EXE files, otherwise known as Cabinet files (available from: http://www.winzip.com) While putting together this uninstaller, I inspected, tested, installed, and uninstalled the following versions of Windows Script (Host): Release Package Date ------- ------- ---- Windows Script 5.6 (beta 2) scr56en.exe 4-4-01 Windows Script 5.6 (beta 1) scr56en.exe 12-1-00 Windows Script 5.5 scr55en.exe 4-3-01 Windows Script 5.5 scr55en.exe 11-28-00 Windows Script 5.1 ste51.exe 4-3-01 Windows Script 5.1 ste51en.exe 11-28-00 Windows Script 5.1 ste51en.exe 11-9-99 Windows Script 5.0 ste50en.exe 5-5-99 Windows Script 5.0 ste50.exe 3-16-99 VBS Support (IE 5.5 SP1) vbscript.cab 10-20-00 VBS Support (IE 5.5) vbscript.cab 6-13-00 VBS Support (IE 5.01 SP2) vbscript.cab 2-26-01 VBS Support (IE 5.01 SP1) vbscript.cab 7-5-00 VBS Support (IE 5.01) vbscript.cab 3-17-00 VBS Support (IE 5.0) vbscript.cab 2-18-99 Windows Script Host 2.0 (beta) wsh20en.exe 5-7-99 Windows Scripting Host (Win98SE)n/a 5-3-99 Windows Scripting Host (Win98) n/a 5-11-98 Windows Scripting Host 1.0 wsh.exe 6-25-98 One general observation about all these various different versions and packages of Windows Script (Host): the files and Registry keys are remarkably consistent (even uniform) across distributions. Even though early distributions (circa 1997/98) may lack files and Registry keys included in later versions, the Registry entries and file names that are present in those packages will not change in later versions. The big exceptions here are the Windows Script 5.6 betas, which introduce a number of new Registry keys and one new .DLL file in Windows NT 4.0. ========= Fun Stuff ========= One of the nicer, more powerful aspects of this uninstall utility is that it can be completely customized by the user. In fact, there may be options or configurations that you do not want this uninstaller to perform or that you want it to perform in a different manner. Not to fret -- the Windows Script (Host) Uninstaller can be customized to do exactly and only what you want it to do. Customizing the Windows Script (Host) Uninstaller involves editing two different types of files: - batch files (i.e., the WSH-UN.BAT file) - .REG files (Windows Registry files) The main uninstaller program itself is a batch file, which is editable with a simple text editor like Windows Notepad. WSH-UN.BAT not only displays all the options menus, but it does a good deal of the uninstallation work itself. In many cases, however, WSH-UN.BAT uses .REG files (Windows Registry files) -- also editable with a simple text editor -- to uninstall various aspects of Windows Script (Host). What follows are brief descriptions of how to edit and customize these files. --------------------- Editing the .BAT File --------------------- The WSH-UN.BAT program is a batch file which is editable with any simple text editor like Windows Notepad. To open an WSH-UN.BAT in Windows Notepad you can either: - right-click on WSH-UN.BAT and select "Edit" from the context menu that pops up - open Windows Notepad, navigate through the "File - Open..." dialog box to the folder that contains WSH-UN.BAT, and open it from there Once you open the WSH-UN.BAT batch file, you will notice that it is divided into major sections corresponding to the choices on the main menu. Each section has its own sub-menu and is itself divided into sub-sections. All titles of sections and sub-sections are preceded by a single colon. For example, the main uninstallation section is headed by this entry: :UNINSTALL You will also find may lines which are not executable -- that is, there are lines that consist of "comments" that have been "remarked" out so that Windows will ignore them when executing WSH-UN.BAT. All "remarked" out "comment" lines are preceded by a double set of colons (::). For example, Windows will ignore the following lines in the WSH-UN.BAT batch file: :: -------------- :: Ask To Confirm :: -------------- These "comments" exist mainly to help someone looking at the file follow and understand all the different commands, the sequence in which they are edited, and why they are where they are. One of the most straightforward customizations you can make to WSH-UN.BAT is to "remark" out a line to prevent it from executing. For example, say you decide that you don't want WSH-UN.BAT to remove the WSCRIPT.HLP (Help) file from the \HELP directory in Windows 98. To prevent WSH-UN.BAT from removing this file, you would find the following line... if exist %WINDIR%\HELP\wscript.hlp del %WINDIR%\HELP\wscript.hlp ...and insert double colons (::) so that they look like this: :: if exist %WINDIR%\HELP\wscript.hlp del %WINDIR%\HELP\wscript.hlp With the double colons (::) at the start of these lines, Windows will ignore the line and not remove the file WSCRIPT.HLP. By the way, that funny looking %WINDIR% is an environment variable which means specifies the "currently installed Windows directory." In Windows 9x this will usually be: C: \WINDOWS. In Windows NT 4.0 this will usually point to: C:\WINNT. Note that "commenting" out the above line would apply only to uninstallations of Windows Script (Host) from Windows 9x (as the above line is from the 9X-UNINST sub-section of UNINSTALL). There is another identical line later in the .BAT file (in the NT-UNINST sub- section) that removes WSCRIPT.HLP from Windows NT 4.0 installations By the way, another way to "remark" out a line in a batch file like WSH-UN.BAT is to use the letters REM (not case sensitive) at the start of a line instead of double colons: REM if exist %WINDIR%\HELP\wscript.hlp del %WINDIR%\HELP\wscript.hlp There are other customizations that you can make to the WSH-UN.BAT batch file, but the above is the simplest and most straightforward type. If you make any changes to the WSH- UN.BAT file, don't forget to save your changes in Notepad. ------------------ Editing .REG Files ------------------ WSH-UN.BAT sometimes uses .REG files (Windows Registry files) to uninstall certain parts of Windows Script (Host). .REG files are, in reality, merely text files formatted for use by REGEDIT.EXE. As such, they can be edited using any simple text editor like Windows Notepad. To open one of the .REG files in Windows Notepad you can either: - right-click on the appropriate .REG file and select "Edit" from the context menu that pops up - open Windows Notepad, navigate through the "File - Open..." dialog box to the folder that contains WSH-UN.BAT, and open it from there If you edit one of the .REG files in a text editor like Notepad, you will not only be able to see the Registry entries that will be added or (in most cases here) deleted when WSH- UN.BAT "merges" that .REG file into the Registry, but you will be able to add or modify entries. Here's a quick introduction to the syntax of the entries in the .REG files using part of one particular .REG file that WSH-UN.BAT uses: WSH-UN.BAT uses .REG files mainly to delete or disable certain Registry keys and values. To remove Registry entries which define Windows Script Extensions and Registered File Types from the Registry, WSH-UN.BAT merges the UN-EXT.REG file into the Registry. Among the first few lines that UN-EXT.BAT contains are: [-HKEY_CLASSES_ROOT\.JS] [-HKEY_CLASSES_ROOT\.VBS] [-HKEY_CLASSES_ROOT\.WSH] These bracketed lines specify the Registry keys to be deleted from the Registry. The hyphens or "minus" signs ( - ) right before the HKEY_ parts tell REGEDIT.EXE (the program which actually does the direct work on the Registry) that what follows is to be deleted, not added, to the Registry. If you take a look a UN-EXT.REG you'll notice that there are other lines in UN-EXT.REG which have been "commented" or "remarked" out -- with a semi-colon ( ; ), not double colons [::] as in batch files. To disable the same three lines from above so that they would not be "merged" into the Registry (thus deleting the specified keys from the Registry), we would add semi-colons to the start of each line so that they looked like this: ; [-HKEY_CLASSES_ROOT\.JS] ; [-HKEY_CLASSES_ROOT\.VBS] ; [-HKEY_CLASSES_ROOT\.WSH] One bit of advice about disabling entire .REG files: the easiest way to prevent an entire .REG file from being "merged" into the Registry by WSH-UN.BAT is not to edit the .REG file; the easiest way is to simply "remark" out the line in WSH-UN.BAT which "merges" the .REG file. For example, the line from WSH-UN.BAT which actually merges the UN-EXT.REG file both look like this: start /w regedit.exe /s un-ext.reg Again, this line appears twice in WSH-UN.BAT: once in the 9X-UNINST section (for Windows 9x), and once in the NT-UNINST section (for Windows NT 4.0). If you make any changes to .REG files, don't forget to save your changes in Notepad. Finally, please note that the file attribute of all the .REG files are set to "Read Only" by default, meaning that you won't be able to save any changes you make to these .REG files until you take off the "Read Only" attribute. To take the "Read Only" attribute off a .REG file... - right-click (context click) on the appropriate .REG file and select "Properties" from the context menu. - uncheck the "Read-only" box (in the "Attributes" section on the "General" tabbed page) - click "OK" to save your changes. With the "Read Only" attribute off, you should now be able to save your changes to the .REG file. ================ More Information ================ Microsoft's Windows Script (WS) has received extensive coverage in the popular tech media, esp. following the outbreak of the "Melissa" and "I Love You" viruses. For more info on WS from the "horse's mouth," consult Microsoft's documentation at the Microsoft Scripting page: http://msdn.microsoft.com/scripting/ Uninstalling Windows Script (Host) is not the only option available to users who are concerned about this powerful set of programming tools. In the wake of the devastation caused by the "I Love You" virus, Fred Langa has once again proven to be a useful source for info on Windows security threats. Check out "Four Ways to Disable Windows Scripting" from his May 11, 2000 newsletter: http://www.langa.com/newsletters/2000/2000-05-11.htm Symantec, maker of Norton Anti-Virus, provides both a free tool to disable WS as well as instructions for manually removing WS: http://www.symantec.com/avcenter/venc/data/win.script.hosting.html http://service1.symantec.com/SUPPORT/nav.nsf/docid/2000050512031906 And for yet another set of instructions to disable WS, see: http://www.us.sophos.com/support/faqs/wsh.html Evidently Microsoft hasn't taken kindly to recommendations to uninstall or disable WS. In a recent post (12/21/00) to GRC's "OptOut" newsgroup (http://grc.com/discussions.htm), Kevin McAleavey of the Privacy Software Corporation (makers of NSClean, IEClean, and BOClean), warned readers that: "Just so you know, Microsoft went *volcanic* over that recommendation as well as our own recommendation to do so a few days earlier on our site. Now, any time you install anything from Microsoft or allow "windows updates" they now replace the files and restore the registry settings. "Therefore, if you delete the files yourself or diddle the registry, make it a POINT to go look for those files on a regular basis ... they DO come back eventually in all their "glory" ... keeping those zombies dead was a critical part of our IEClean design. Microsoft *insists* upon restoring those files in preparation for ... 'Microsoft dotNET' ..." The program Kevin McAleavey plugs here, IEClean, is a highly regarded privacy tool that can be purchased at: http://www.nsclean.com You can read the Privacy Software Corporation's warnings about the security risks of WS and look at still another set of instructions for removing it at: http://www.nsclean.com/psc-vbs.html For links to still more information on Windows Script, see: http://www.spywarewarrior.com/uiuc/info10a.htm There are several other useful tools out there on the Net that can disable or "de-fang" Windows Script (Host) without uninstalling it. You can find links to a good number of these tools at my web site at the University of Illinois at Urbana-Champaign: http://www.spywarewarrior.com/uiuc/soft4.htm Of the many 3rd party tools available to "defang" Microsoft's WS, one in particular is worthy of separate mention: ScriptSentry, a free tool from Jason Levine (formerly of WinMag.com). ScriptSentry (which is an improved version of the WatchDog utility at the old WinMag.com site) deals with the WS security threat much more subtly than my WSH-UN.BAT batch file manages to do, and it has the added benefit of allowing you to keep WS installed and running, albeit in a "safe" environment. You can read about and download ScriptSentry from: http://www.jasons-toolbox.com/scriptsentry.asp Another such utility, EBURGER (a batch file, in fact, like the Windows Script Host Uninstaller), is available on my web site: http://www.spywarewarrior.com/uiuc/resource2.htm EBURGER can help you do more than just safely configure Windows Script (Host). It can also configure NetBIOS Over TCP/IP, Microsoft's DCOM, and Browser Helper Objects. Finally, if you're concerned about accessing Microsoft's "Windows Update" site after uninstalling Windows Script (Host), you might be interested in this page: http://www.spywarewarrior.com/uiuc/ws-winupd.htm ==================== Problems & Questions ==================== I hope you find this Windows Script (Host) Uninstaller helpful in your attempts to ensure your privacy and security while using Windows. If you run into serious problems with this batch file utility, and you have made every attempt to address the problem but remain stumped, I can be reached at: eburger68@myrealbox.com Please keep in mind that my busy schedule may not allow me to respond immediately. I will attempt to get back to you, though, and address your questions. Other helpful resources for getting answers to questions about Windows security and privacy include the GRC Privacy & Security news groups, which are generously hosted by Steve Gibson of Gibson Research (GRC): http://grc.com/discussions.htm I've found the folks who hang out in these groups to be helpful, knowledgeable, and passionate. Finally, you might also check out my web site at The University of Illinois at Urbana- Champaign, a site which contains a bevy of links to information and software relevant to Privacy & Security on the Internet: http://www.spywarewarrior.com/uiuc/ ------------------------------------------------- Date: 4/28/01, 3/26/02 From: http://www.spywarewarrior.com/uiuc/ Made By: Eric L. Howes (eburger68@myrealbox.com) ------------------------------------------------- Copyright (c) 2000-2002 Eric L. Howes This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. Some files distributed with this package may not be covered by the GNU GPL. Those files remain the property of their original owners and are covered by the licenses under which they were originally distributed. All trademarks are the property of their respective owners. You should have received a copy of the GNU General Public License along with this program; see the file COPYING. If not, write to the Free Software Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.