Windows 10 suddenly refuses to run VBS script [Code 800A802D]

Question

Windows Version: 21H1 (OS Build 19043.1151) [Windows 10 Pro 64-Bit] AV is Windows Defender & brain.exe

Now to my problem:

Since recently I no longer can run my VBS script. error-msg and exclusion

---------------------------
Windows Script Host
---------------------------
Script: C:\_Operations\Aebian\BorderlessGaming\BorderlessGaming.vbs
Line:   3
Char:   1
Error:  This script contains malicious content and has been blocked by your antivirus software.: 'Run'
Code:   800A802D
Source:     Microsoft VBScript runtime error

---------------------------
OK   
---------------------------

The script worked flawlessly in the past without issues. Content of the script is the following:

Dim WinScriptHost
Set WinScriptHost = CreateObject("WScript.Shell")
WinScriptHost.Run Chr(34) & "C:\_Operations\Aebian\BorderlessGaming\BorderlessGaming.bat" & Chr(34), 0
Set WinScriptHost = Nothing

This then runs the actual script. I use a VBS because otherwise I would always have a CMD window left open I would have to manually close. The BAT file looks like this:

@echo off
:loop
Start /MIN "" "C:\Programs\Borderless Gaming\BorderlessGaming.exe"
timeout /t 1800 >nul
taskkill /F /IM "BorderlessGaming.exe" >nul
goto loop

In my exclusion I have the whole folder and also the VBS file directly (as seen in the screenshot above). Is there anything else I'm mising? I wonder why this is a problem now but wasn't back then three days ago.

Any help greatly appreciated, thanks.

Answer 1

I have now changed the process how the script is called. Since the original VBS file in my post above has made troubles.

' Run BAT invisible - Usage: wscript.exe "C:\_Operations\Aebian\util\vbi.vbs" "C:\_Operations\Aebian\BorderlessGaming\BorderlessGaming.bat"
CreateObject("Wscript.Shell").Run """" & WScript.Arguments(0) & """", 0, False

Basically I have now a "dedicated" VBS file that takes one argument. It will run my BAT file without issues. In the comment on the first line you will see how it works. I named the VBS-File vbi.vbs but you can name yours to whatever.

Thanks for all your help.

Answer 2

I submitted a "false positive" report on this issue to the Windows Defender team. They "removed the definition" that was triggering the "malicious code" block with this sample script:

Set oShell = CreateObject("WScript.Shell")
oShell.Run "taskkill /f /im mspaint.exe"

I just checked now with Windows Defender definitions 1.345.247.0 and the above script now runs without error. I think this update should allow your original script to run clean. At the very least, I have confirmed that the following code, which is your original script done completely in VBScript, runs fine now.

Set oShell = CreateObject("WScript.Shell")
Do While True
    oShell.Run Chr(34) & "C:\Programs\Borderless Gaming\BorderlessGaming.exe" & Chr(34), 2, 0
    WScript.Sleep 1800000
    oShell.Run "TaskKill /im BorderlessGaming.exe /f", 0, 1
Loop