Can't find script engine "VBScript" for script after installing MS10-020

Summer is here and support volumes trickle down to a minimum as people jump into their SUV's and drive off into the wild blue yonder.
Having said that I encountered the following interesting issue:

We installed the fix from KB 981332 on a Windows 2008 R2 server and after that we're not able to run any VBS script.

When trying to run any VB script we get the following error

Can't find script engine "VBScript" for script

Sample script we are using for test:

wscript.echo " Hello World"

We have uninstalled the fix but because the problem persists we have installed it again.

Looking at a Procmon trace taken while an attempt was made to run a script we noticed that cscript.exe was in fact being called but when the value defining which scripting engine to use for .vbs files was being read (HKCRCLSID{B54F3741-5B07-11CF-A4B0-00AA004A55E8}InprocServer32(Default) ) we saw that the default vbscript.dll value had been replaced with a DLL from an antivirus vendor.

This is typical behavior when the antivirus application wants to scan the scripts before handing it over to the script engine, i.e. the AV application first scans the script and then passes it down to the actual scripting engine when it's done scanning.

Fair enough, but something seems to have gone wrong with the chaining from the antivirus vendors scanning DLL after MS10-020....which results in it not finding the vbscript.dll file and this in turn results in the error Can't find script engine "VBScript" for script.

Searching for the symptoms on the Internet returns a lot of hits so I assume this may be an issue that affects more than one antivirus vendor.

Temporarily uninstalling the AV product as a test should confirm if this is the case, you should however confirm that the registry key has been reverted properly back to use vbscript.dll so that the VBScript engine gets called directly.

Another alternative would be to manually edit the reference using Regedit, but as the TrustedInstaller security principal owns the registry key this would require taking ownership of the key and granting yourself permissions to manually modify it the uninstallation is the preferred method (and the only supported method).

 

Further details:

MS10-022: Description of the security update for Visual Basic Scripting (VBScript) 5.8: April 13, 2010
http://support.microsoft.com/default.aspx?scid=kb;EN-US;981332