Scripts

  • Thread starter Thread starter rickyt00
  • Start date Start date
R

rickyt00

I am trying to create a script to remove the
blaster/others from windows 2000 machines. Is it possible
to use WMI, without having a true windows network. I am
able to do somethings with WMI but not all it seems.
Thanks
 
rickyt00 said:
I am trying to create a script to remove the
blaster/others from windows 2000 machines. Is it possible
to use WMI, without having a true windows network. I am
able to do somethings with WMI but not all it seems.
Thanks
Click to expand...

Hi

Here is a script that you can run on a local computer (e.g. stating it from a
logon script):


CleanupWorm

Sub CleanupWorm

Set oShell = CreateObject("WScript.Shell")
Set oFSO = CreateObject("Scripting.FileSystemObject")
sWinSysDir = oFSO.GetSpecialFolder(1)
sWinDir = oFSO.GetSpecialFolder(0)

On Error Resume Next

' Welchia
oShell.Run sWinSysDir & "\net.exe stop RpcTftpd", 0, True
oShell.Run sWinSysDir & "\net.exe stop RpcPatch", 0, True

oShell.RegDelete "HKLM\SYSTEM\CurrentControlSet\Services\RpcTftpd\ImagePath"
oShell.RegDelete "HKLM\SYSTEM\CurrentControlSet\Services\RpcPatch\ImagePath"
oFSO.DeleteFile sWinSysDir & "\Wins\Svchost.exe", True
oFSO.DeleteFile sWinSysDir & "\Wins\Dllhost.exe", True

'Blaster orginial + B
oShell.RegDelete _
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows auto update"
oFSO.DeleteFile sWinSysDir & "\msblast.exe", True
oFSO.DeleteFile sWinSysDir & "\penis32.exe", True


'Blaster C
oShell.RegDelete _
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Inet Xp.."
oFSO.DeleteFile sWinSysDir & "\Teekids.exe", True

' Sobig.f
oShell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrayX"
oFSO.DeleteFile sWinDir & "\winppr32.exe", True

End Sub
 
Back
Top