' Mypic.bmp.vbs Removal System
' By Peregrinus
' #AvA on Austnet
' Bugs fixed by ZouK1 and MrSimpson on Efnet
' 2/1/2000

' Variables
Dim WSHShell, fso
Set WSHShell = Wscript.CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set wfolder = fso.GetSpecialFolder(0)
Set sfolder = fso.GetSpecialFolder(1)
Set tfolder = fso.GetSpecialFolder(2)
DesktopPath = WSHShell.SpecialFolders("Desktop")

' The Welcome
WScript.Echo "Welcome, you are using the Mypic.bmp.vbs/Mypicture.bmp.vbs remover called mypicrem.vbs. PLEASE Close All Programs Ie: mIRC/Pirch, Your Internet connection, and Anything else that you may have open."
WScript.Echo "Did you close the mIRC or PIRCH?? not yet? Please Close Them.. This is your last warning, YOU MUST CLOSE THEM FIRST!!" 
L_Welcome_MsgBox_Message_Text   = "Do you want get rid of the virus Mypic.bmp.vbs or Mypicture.bmp.vbs or from your computer?"
L_Welcome_MsgBox_Title_Text     = " Created By Peregrinus #AvA - the Mypic.bmp.vbs/Mypicture.bmp.vbs Remover, Bugs Fixed By ZouK1 and MrSimpson on Efnet"
Call Welcome()

' Removal Action
On Error Resume Next
Call RegRem()
Cancella_file(wfolder & "\mypic.bmp.vbs")
Cancella_file(wfolder & "\MyPicture.bmp.vbs")
Cancella_file(sfolder & "\RUNDLL.VBS")
Cancella_file(sfolder & "\mypic.bmp.vbs")
Cancella_file(sfolder & "\MyPicture.bmp.vbs")
Cancella_file(tfolder & "\MyPicture.bmp.vbs")
Cancella_file(tfolder & "\mypic.bmp.vbs")
Cancella_file("C:\MyPicture.bmp.vbs")
Cancella_file("C:\MyPic.bmp.vbs")
Cancella_file("\MyPicture.bmp.vbs")
Cancella_file("\MyPic.bmp.vbs")
Cancella_file("C:\mirc\MyPicture.bmp.vbs")
Cancella_file("C:\mirc\MyPic.bmp.vbs")
Cancella_file("C:\mirc\download\MyPicture.bmp.vbs")
Cancella_file("C:\mirc\download\MyPic.bmp.vbs")
Cancella_file("C:\mirc\script.ini")
Cancella_file("C:\windows\system\MyPicture.bmp.vbs")
Cancella_file("C:\WINDOWS\Start Menu\Programs\StartUp\RunDLL.vbs")
Cancella_file("C:\My Documents\MyPicture.bmp.vbs")
Cancella_file("C:\MyPicture.bmp.vbs")
Cancella_file("C:\PROGRA~1\mirc\script.ini")
Cancella_file("C:\archiv~1\mirc\script.ini")
Cancella_file("C:\PROGRA~1\mirc\download\MyPic.bmp.vbs")
Cancella_file("C:\PROGRA~1\mirc\download\MyPicture.bmp.vbs")
Cancella_file("C:\archiv~1\mirc\download\MyPic.bmp.vbs")
Cancella_file("C:\archiv~1\mirc\download\MyPicture.bmp.vbs")
Cancella_file("C:\pirch98\MyPic.bmp.vbs")
Cancella_file("C:\pirch98\MyPicture.bmp.vbs")
Cancella_file("C:\pirch98\events.ini")
Cancella_file("C:\PROGRA~1\pirch98\events.ini")
Cancella_file("C:\archiv~1\pirch98\events.ini")
Cancella_file("C:\PROGRA~1\pirch98\MyPic.bmp.vbs")
Cancella_file("C:\PROGRA~1\pirch98\MyPicture.bmp.vbs")
Cancella_file("C:\archiv~1\pirch98\Mypic.bmp.vbs")
Cancella_file("C:\archiv~1\pirch98\MyPicture.bmp.vbs")
Cancella_file("C:\windows\MyPicture.bmp.vbs")
Cancella_file("C:\windows\MyPic.bmp.vbs")
Cancella_file("C:\mirc\mirc.ini")
Cancella_file("C:\Millennium.NFO")
Cancella_file("C:\short.com")
WSHShell.Popup "The Virus MyPicture.bmp.vbs or MyPic.bmp.vbs Is Now Deleted from your computer!"
Correr_Prog("c:\mirc\mirc32.exe")
Correr_Prog("c:\PROGRA~1\mirc\mirc32.exe")
Correr_Prog("c:\archiv~1\mirc\mirc32.exe")
Correr_Prog("c:\pirch98\pirch98.exe")
Correr_Prog("c:\PROGRA~1\pirch98\pirch98.exe")
Correr_Prog("c:\archiv~1\pirch98\pirch98.exe")
' fso.DeleteFile(WScript.ScriptFullName)

' Sub Programs

Sub RegRem()
  On Error Resume Next
 ' WSHShell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll"
 ' WSHShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\TaskMonitor"
 ' WSHShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry"
 ' WSHShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\TaskMonitor"
 ' WSHShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Sent?"
 ' WSHShell.RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner"
' WSHShell.RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\runservices\winload"
 '  WSHShell.RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOrganization"
 '  WSHShell.RegDelete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProductName"
' WSHShell.Popup "The Viruses MyPicture.bmp.vbs and MyPic.bmp.vbs have been unloaded from the Windows Registry."
End Sub

Sub Cancella_file(filespec)
  If (fso.FileExists(filespec)) Then
    fso.DeleteFile(filespec)
    WSHShell.Popup "The infected file with virus named " & filespec & " has been removed!!"
  End If
End Sub

Sub Correr_Prog(filespec)
  If (fso.FileExists(filespec)) Then
    WSHShell.Run(filespec)
  End If
End Sub

Sub Welcome()
  Dim intDoIt
  intDoIt =  MsgBox(L_Welcome_MsgBox_Message_Text,    _
  vbYesNo + vbInformation,       _
  L_Welcome_MsgBox_Title_Text )
  If intDoIt = vbNo Then
    WScript.Quit
  End If
End Sub