Isn't it possible to prevent this by disabling the windows scripting host?