You've probably heard many reports recently about Windows script viruses traversing the Internet, wreaking havoc with file systems and otherwise being a general nuisance. This threat is made more sinister by another "feature" of Windows that, by default, hides the extensions of known file types. Using this to their advantage, hackers have taken to naming their script files with double extensions, like myhackerscript.doc.vbs. Windows only looks at the last part of the filename as the extension, thus it decides this is a known file type (.vbs) and hides that part of the filename. What you see then in your email is a file called myhackerscript.doc, which you innocently mistake for a document. Opening the "document" though, runs the script and exposes your system to whatever commands it contains. This is how the much talked about Anna Kournikova virus spread so rapidly.
You may even have taken the recommended steps to minimize your exposure to this risk, such as disabling auto-preview in your email program and turning off Windows scripting support. But what if you really like auto-preview and want to continue using it? Isn't there some other way of protecting yourself against script viruses without losing this feature? And you may have found that turning off Windows scripting support causes some web pages to not work properly. What else can you do?
One option is to change the association of Windows scripts (vbscripts) to a non-executable program, such as Notepad. If you don't understand associations, here's how it works. You know how you can often just double-click a filename and Windows "knows" what program to open it with? Windows isn't really that smart. It just checks the filename's extension (.doc, .xls, .txt, etc.) and looks up the name of the associated file to start it with. How do associations get established? There are a number of default associations that are set up when Windows is installed. Subsequent installations of other programs can also associate filename extensions with their particular program. An example is Adobe's Acrobat, which uses the extension .pdf for its files. Once installed, Adobe Acrobat is automatically opened whenever a file ending with .pdf is double-clicked.
Although they're not obvious, these associations can be edited by experienced users or even a novice user with some decent instructions (like those that follow). Here's how:
Open the Windows Explorer (not Internet Explorer) and from the pull-down menus, choose Tools,then Folder Options...
On the screen that appears next, choose the tab labeled File Types and scroll down the list of Registered file types until you see VBScript Script File, as shown here. (tip: to jump to it quickly, click once in the list, then press 'V')
Notice that these file types are associated with a Windows program called WSCRIPT. This is the default Windows scripting host. Change the file association by selecting VBScript Script File and then clicking on the Edit button. The following window will appear:
Click the Open Action to select it, as shown above. Then click the Edit button and you will see (yet another) window something like this:
This is the one that tells Windows what program to use and how to run the file. Change it to read:
C:\WINDOWS\Notepad.exe "%1" %*
Note that you only need to highlight the word WScript and replace it with Notepad, but if you accidentally replace the whole line, just be sure to type it in exactly as above.
If you change the association of .vbs files to a benign program like Notepad, scripts will be unable to run automatically. However, you'll still know when they try to run, because Notepad will come up on the screen automatically and will display the contents of the script. Want to test it? If you don't have a script file handy, just make a copy of any text file and rename it from oldname.txt to oldname.vbs, then double-click it. What should happen is it will open in Notepad, allowing you to view the contents of the file.
If in fact you really do have a script that you intended to run, you can use this alternate method to start it:
Click on the Windows Start button, then choose Run... from the pop-up menu. In the dialog box that appears, type WSCRIPT <space> {path and name of script file to run}
This starts the scripting host and tells it to run your script, yet the automation is still disabled because Windows no longer "knows" that script files belong with this program.