Endpoint Protection fails to execute Host Integrity check even though cscript.exe runs
search cancel

Endpoint Protection fails to execute Host Integrity check even though cscript.exe runs

book

Article ID: 172189

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection (SEP) client is failing to execute a Host Integrity check. Cscript.exe can be seen running when the check starts, but it fails to process the script. The steps in TECH214426 did not resolve the issue.

Fail to execute Host Integrity check.
 Error Type: 0x02000008, Error Code: 0x00000000

Cause

JScript class has been modified to point to a different dll as seen via the registry:
HKCR\JScript\CLSID\(Default)
Data: {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}

HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\(Default)
Data: <path to third party dll>

Note: Additional classes may be similarly modified, such as VBScript:
HKCR\VBScript\CLSID\(Default)
Data: {B54F3741-5B07-11cf-A4B0-00AA004A55E8}

HKCR\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32\(Default)
Data: <path to third party dll>

Resolution

  1. Open a cmd.exe prompt as administrator.
  2. Run: regsvr32 C:\Windows\System32\jscript.dll
  3. Confirm in the registry that the correct DLL path is now present.
  4. Repeat steps 2 and 3 for vbscript.dll, if necessary.

Expected values:
HKEY_CLASSES_ROOT\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\(Default)
Data: C:\Windows\System32\jscript.dll

HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32\(Default)
Data: C:\Windows\System32\vbscript.dll