Set fso = CreateObject("Scripting.FileSystemObject")
Set trgexe = fso.GetSpecialFolder(1)
mInfected = False

If (fso.FileExists(trgexe & "\msblast.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\penis32.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\wuaumgr.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\teekids.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\root32.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\msconfig35.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\mspatch.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\mslaugh.exe")) Then
  mInfected = True
End If

If (fso.FileExists(trgexe & "\enbiei.exe")) Then
   mInfected = True
End If

If NOT mInfected Then

  MsgBox "The Blaster Worm was not found, Your computer is ok.",16, "Nothing was Done!"

Else

  KillWorms()
  MsgBox "The Blaster Worm was removed from your computer." & vbCR & "Install the Microsoft patch to prevent this from happening again.", vbOKOnly, "Removed!"

End If

On Error Resume Next

Set WshShell = WScript.CreateObject("WScript.Shell")

If WshShell.RegRead("HKLM\Software\Microsoft\Updates\Windows XP\SP2\KB823980\Description") <> "Windows XP Hotfix - KB823980" Then

  X = MsgBox("Would you like to download the MS patch?", vbYesNo, "Very Important!")
  
  If X = 6 Then
          WshShell.Run("http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS03-039.asp")
  End If

Else

  MsgBox "You Have The Patch Installed", 48,"KB823980 Patch"

End If

On Error Goto 0

Set WshShell = Nothing
Set fso = Nothing

Public Function killWorms()
  For Each Process in GetObject("winmgmts:"). _
      ExecQuery ("select name from Win32_Process where name='msblast.exe' OR name='penis32.exe' OR name='teekids.exe' OR name='wuaumgr.exe' OR name='root32.exe' OR name='msconfig35.exe' OR name='mspatch.exe' OR name='mslaugh.exe' OR name='enbiei.exe'")
    Process.terminate(0)
  Next

  On Error Resume Next

  fso.DeleteFile trgexe & "\msblast.exe",True
  fso.DeleteFile trgexe & "\penis32.exe",True
  fso.DeleteFile trgexe & "\teekids.exe",True
  fso.DeleteFile trgexe & "\wuaumgr.exe",True
  fso.DeleteFile trgexe & "\root32.exe",True
  fso.DeleteFile trgexe & "\msconfig35.exe",True
  fso.DeleteFile trgexe & "\mspatch.exe",True
  fso.DeleteFile trgexe & "\mslaugh.exe",True
  fso.DeleteFile trgexe & "\enbiei.exe",True

  With WScript.CreateObject("WScript.Shell")

    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\windows automation"
    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\windows auto update"
    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Inet Xp.."
    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig"
    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Nonton Antivirus"
    .RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Nonton Antivirus"
    .RegDelete "HLKM\Software\Microsoft\Windows\CurrentVersion\Run\www.hidro.4t.com"

  End With

  On Error GoTo 0
End Function