' VBScript source code
Dim wshShell, fso, badfile, logfile, ZotobKey

'Instanciate the FileSystemObject and Shell object
Set fso = CreateObject("Scripting.FileSystemObject")
Set WshShell = WScript.CreateObject("WScript.Shell")

'Create Log file if it doesn't exist
If fso.FileExists("c:\AVRemover.log") Then
   set logfile = fso.OpenTextFile("c:\AVRemover.log",8,TRUE)
Else
   Set logfile = fso.CreateTextFile("c:\AVRemover.log")
End IF

'Create seed log entry
logfile.writeline "Script Entry "&date()&" "&time()

'Check for zotob.g
on error resume next
ZotobKey = wshShell.regread ("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDrg32")
logfile.writeline "W32.Zotob.G Registry key found and removed"
if err = 0 Then
   WshShell.RegDelete ("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinDrg32")
   if fso.FileExists(ZotobKey) then
	badfile = fso.GetFile(ZotobKey)
	badfile.delete
	logfile.writeline "W32.Zotob.G executable found and removed"
   end if
End If

'Connect to local computer's WMI
strComputer = "."
Set objWMIService = GetObject("winmgmts:"_
	& "{impersonationLevel=impersonate}!\\" &strComputer & "\root\cimv2")

'Within WMI, pull any services matching our names
Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service where Name = 'wpa' or Name = 'mousebm' or Name = 'MouseSync' or Name = 'msrpc32'or Name = 'tftp1544'")

'For each service matching our name above, disable, stop, delete, and hunt down and kill its parents
For Each objService in colServiceList
    errReturnCode =     objService.Change( , , , , "Disabled") 
    objService.StopService()  
    objService.Delete()
    set badfile = FSO.GetFile(objService.PathName)
    badfile.delete
    logfile.writeline objService.name&" at "&objService.PathName&" removed."
Next

'End log entry and close log file
logfile.writeline "Script Entry Complete."
logfile.close