Can’t find script engine "VBScript" for script after installing MS10-020

Summer is here and support volumes trickle down to a minimum as people jump into their SUV’s and drive off into the wild blue yonder.
Having said that I encountered the following interesting issue:


We installed the fix from KB 981332 on a Windows 2008 R2 server

and after that we’re not able to run any VBS script.


When trying to run any VB script we get the following error


Can’t find script engine “VBScript” for script


Sample script we are using for test: 


wscript.echo ” Hello World”


We have uninstalled the fix but because the problem persists we have installed it again.

Looking at a Procmon trace taken while an attempt was made to run a script we noticed that cscript.exe was in fact being called but when the value defining which scripting engine to use for .vbs files was being read (HKCRCLSID{B54F3741-5B07-11CF-A4B0-00AA004A55E8}InprocServer32(Default)) we saw that the default vbscript.dll value had been replaced with a DLL from an antivirus vendor.

This is typical behavior when the antivirus application wants to scan the scripts before handing it over to the script engine, i.e. the AV application first scans the script and then passes it down to the actual scripting engine when it’s done scanning.

Fair enough, but something seems to have gone wrong with the chaining from the antivirus vendors scanning DLL after MS10-020….which results in it not finding the vbscript.dll file and this in turn results in the error
Can’t find script engine “VBScript” for script.

Searching for the symptoms
on the Internet returns a lot of hits so I assume this may be an issue that affects more than one antivirus vendor.

Temporarily uninstalling the AV product as a test should confirm if this is the case, you should however confirm that the registry key has been reverted properly back to use vbscript.dll so that the VBScript engine gets called directly.

Another alternative would be to manually edit the reference using Regedit, but as the TrustedInstaller security principal owns the registry key this would require taking ownership of the key and granting yourself permissions to manually modify it the uninstallation is the preferred method (and the only supported method).


Further details:

MS10-022: Description of the security update for Visual Basic Scripting (VBScript) 5.8: April 13, 2010;EN-US;981332



Comments (10)

  1. Anonymous says:

    Thank you. Glory to God.

    My problem was solved after removing the registry key that was pointing to a Mcafee antivirus.

    The antivirus avia been removed incorrectly.


    [HKEY_LOCAL_MACHINE SOFTWARE Classes CLSID {B54F3741-5B07-11cf-A4B0-00AA004A55E8} InprocServer32]

    @ = "C: Program Files Common Files McAfee SystemCore ScriptSn.20101116171926.dll"

    "ThreadingModel" = "Both"


    [HKEY_LOCAL_MACHINE SOFTWARE Classes CLSID {B54F3741-5B07-11cf-A4B0-00AA004A55E8} InprocServer32]

    @ = "C: Windows System32 vbscript.dll"

    "ThreadingModel" = "Both"

    Can not find script engine vbscript.


  2. Garry Trinder says:

    If it's been deleted from your hard drive then you need to obtain it from somwhere – it is installed by default and should be available on the installation media you got with your system.

    It could alternatively be copied from another system with the same OS & SP level.

  3. Scott Rochford says:

    Another alternative to manually updating the registry entry is to do a "regsvr32 c:windowssystem32vbscript.dll" which does the job for you.

  4. Rishi says:

    I don't have vbscript.dll in my system32 folder. what shall i do now?

  5. Rishi says:

    Chuck it. i downloaded vbscript.dll separately and pasted it. The Scripts 5.8 won't get installed as "Your machine already has some higher version blah blah". So 5.8 didnt get installed. Now things are ok ! phew !

  6. Rishi says:

    Hey thanks . i didnt see your reply 🙂

  7. Mevo says:

    Another alternative to manually updating the registry entry is to do a "regsvr32 c:windowssystem32vbscript.dll" which does the job for you.

    This worked for me!

    Thanks Scott!

  8. Zora says:

    Thanks very much!

    Eventually repaired 🙂

  9. Levi says:

    Looks like it was possibly done because of a Virus in the first place. I had one user have this issue and it didn’t make any sense because I hadn’t performed any updates to McAfee.…/12722

  10. Technojuncky says:

    Super cool man! saved me a few hundred bucks!