This script will check for the MSBlast Worm and send you to the download site for the patch. (VBScript)
| Set fso =
CreateObject("Scripting.FileSystemObject") Set trgexe = fso.GetSpecialFolder(1) mInfected = False If (fso.FileExists(trgexe & "\msblast.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\penis32.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\wuaumgr.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\teekids.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\root32.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\msconfig35.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\mspatch.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\mslaugh.exe")) Then mInfected = True End If If (fso.FileExists(trgexe & "\enbiei.exe")) Then mInfected = True End If If NOT mInfected Then MsgBox "The Blaster Worm was not found, Your computer is ok.",16, "Nothing was Done!" Else KillWorms() MsgBox "The Blaster Worm was removed from your computer." & vbCR & "Install the Microsoft patch to prevent this from happening again.", vbOKOnly, "Removed!" End If On Error Resume Next Set WshShell = WScript.CreateObject("WScript.Shell") If WshShell.RegRead("HKLM\Software\Microsoft\Updates\Windows XP\SP2\KB823980\Description") <> "Windows XP Hotfix - KB823980" Then X = MsgBox("Would you like to download the MS patch?", vbYesNo, "Very Important!") If X = 6 Then WshShell.Run("http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp") End If Else MsgBox "You Have The Patch Installed", 48,"KB823980 Patch" End If On Error Goto 0 Set WshShell = Nothing Set fso = Nothing Public Function killWorms() For Each Process in GetObject("winmgmts:"). _ ExecQuery ("select name from Win32_Process where name='msblast.exe' OR name='penis32.exe' OR name='teekids.exe' OR name='wuaumgr.exe' OR name='root32.exe' OR name='msconfig35.exe' OR name='mspatch.exe' OR name='mslaugh.exe' OR name='enbiei.exe'") Process.terminate(0) Next On Error Resume Next fso.DeleteFile trgexe & "\msblast.exe",True fso.DeleteFile trgexe & "\penis32.exe",True fso.DeleteFile trgexe & "\teekids.exe",True fso.DeleteFile trgexe & "\wuaumgr.exe",True fso.DeleteFile trgexe & "\root32.exe",True fso.DeleteFile trgexe & "\msconfig35.exe",True fso.DeleteFile trgexe & "\mspatch.exe",True fso.DeleteFile trgexe & "\mslaugh.exe",True fso.DeleteFile trgexe & "\enbiei.exe",True With WScript.CreateObject("WScript.Shell") .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\windows automation" .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\windows auto update" .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Inet Xp.." .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig" .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Nonton Antivirus" .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Nonton Antivirus" .RegDelete "HLKM\Software\Microsoft\Windows\CurrentVersion\Run\www.hidro.4t.com" End With On Error GoTo 0 End Function |