How to tell what program is using Windows Based Script Host?

Question

I regularly have Microsoft ® Windows Based Script Host (located at C:\Windows\SysWOW64\wscript.exe) popping in my Task Manager and using a lot of CPU. From my understanding this software is used by third-party scripts. Is there any way to have more detail about what script is using it?

I'm using Windows 10 by the way. And I don't want to disable it altogether because I need it for Python virtual environments.

Answer 1

wscript.exe is also known as Windows Script Host, a service that provides the Windows system with scripting abilities ,generally VBscript and JScript.

In Powershell, you can run this to see all running Wscript.exe instances and their command line:

Get-WMIObject Win32_Process | Where-Object {$_.Name -match ".*wscript.exe.*"} | Select-Object Name,CommandLine

CommandLine is the file location of the wscript.exe instance script.

Answer 2

You can also check what you want as processes, just put them into an array and execute this powershell script :

---

$Processes = @("cmd","mshta","wscript","cscript","powershell")
ForEach ($Process in $Processes)
{
    GWMI Win32_Process | ? {$_.Name -match ".*$Process*"} | Select Handle,Name,CommandLine
}