I'm not a VBScript coder, so I don't understand that code.
But I'm pretty sure the Root Dir of the WWW Service is store in the Registry somewhere. In that case you can get it with a single "ReadRegStr" command in NSIS, you only need to find out the proper key. No VBScript would be needed. So this would be the most easy and reliable way.
However with your VBScript it should work like:
SetOutPath $INSTDIR
File "C:\My Scripts\Foobar.vbs"
nsExec:execToStack '"$SYSTEM\CScript.exe" "$INSTDIR\foobar.vbs"'
Pop $0
MessageBox MB_OK "Tada: $0"
But maybe you must use Cscript.Echo instead of Wscript.Echo ???
[EDIT]
Forget about it. Wscript.Echo works in Cscript.exe as well.
Just tried it 🙂