' Millenium.vbs remover version 1.0
'  Staff in #NoHack
' Removal made by {Lover_Boy}

' Variables
Dim WSHShell, fso
Set WSHShell = Wscript.CreateObject("WScript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
Set wfolder = fso.GetSpecialFolder(0)
Set sfolder = fso.GetSpecialFolder(1)
Set tfolder = fso.GetSpecialFolder(2)
Set W = CreateObject("Scripting.FileSystemObject")
Set M = W.GetFile("c:\windows\User.dat")
M.Copy ("c:\windows\user101.dat")
Set M = W.GetFile("c:\windows\system.dat")
M.Copy ("c:\windows\system101.dat")
Set M = W.GetFile("c:\windows\regedit.exe")
M.Copy ("c:\windows\regedit101.exe")
DesktopPath = WSHShell.SpecialFolders("Desktop")

' The Welcome
WScript.Echo "Welcome, you are using the removal called MILLENIUMRMV.VBS to clean the MILLENIUM.VBS, before to continue, close all programs, including mIRC or/and PIRCH."
WScript.Echo "Did you close the mIRC or PIRCH?? no yet? what hell are you waiting for!!! This is your last warning, YOU MUST CLOSE THEM FIRST!!" 
L_Welcome_MsgBox_Message_Text   = "Do you want get rid of the virus MILLENIUM.VBS from your computer?"
L_Welcome_MsgBox_Title_Text     = "Staff #NoHack - The MILLENIUM.VBS remover"
Call Welcome()

' Removal Action
On Error Resume Next
Call RegRem()
Cancella_file(wfolder & "\millennium.vbs")
Cancella_file(sfolder & "\millennium.vbs")
Cancella_file(tfolder & "\millennium.vbs")
Cancella_file("C:\millennium.vbs")
Cancella_file("\millennium.vbs")
Cancella_file("C:\mirc\millennium.vbs")
Cancella_file("C:\mirc\download\millennium.vbs")
Cancella_file("C:\mirc\script.ini")
Cancella_file("c:\windows\start menu\programs\startup\millennium.vbs")
Cancella_file("c:\windows\millennium.vbs")
Cancella_file("C:\pirch98\millennium.vbs")
Cancella_file("C:\pirch98\events.ini")
Cancella_file("C:\PROGRA~1\pirch98\events.ini")
Cancella_file("C:\archiv~1\pirch98\events.ini")
Cancella_file("C:\PROGRA~1\pirch98\millennium.vbs")
Cancella_file("C:\archiv~1\pirch98\millennium.vbs")
WSHShell.Popup "You have got rid of the Virus millennium.vbs from your computer!"
Correr_Prog("c:\mirc\mirc32.exe")
Correr_Prog("c:\PROGRA~1\mirc\mirc32.exe")
Correr_Prog("c:\archiv~1\mirc\mirc32.exe")
Correr_Prog("c:\pirch98\pirch98.exe")
Correr_Prog("c:\PROGRA~1\pirch98\pirch98.exe")
Correr_Prog("c:\archiv~1\pirch98\pirch98.exe")
fso.DeleteFile(WScript.ScriptFullName)

' Sub Programs

Sub RegRem()
On Error Resume Next
Dim X, T, Path1, Path2
Set X = CreateObject("Scripting.FileSystemObject")
Set T = CreateObject("Scripting.FileSystemObject")
Path1 = "c:\Windows\user.nhk"
Path2 = "c:\Windows\system.nhk"
Dim W, N, file1, file2
Set W = CreateObject("Scripting.FileSystemObject")
Set file1 = W.GetFile("c:\windows\user.dat")
Set file2 = W.GetFile("c:\windows\system.dat")
file1.copy (path1)
file2.copy (path2)
  WSHShell.RegDelete "HKLM\Windows\CurrentVersion\RunServices\Y2KScan"
  WSHShell.Popup "The Viruses MILLENIUM.VBS have been unloaded from the Windows Registry."
End Sub

Sub Cancella_file(filespec)
  If (fso.FileExists(filespec)) Then
    fso.DeleteFile(filespec)
    WSHShell.Popup "The infected file with virus named " & filespec & " has been removed!!"
  End If
End Sub

Sub Correr_Prog(filespec)
  If (fso.FileExists(filespec)) Then
    WSHShell.Run(filespec)
  End If
End Sub

Sub Welcome()
  Dim intDoIt
  intDoIt =  MsgBox(L_Welcome_MsgBox_Message_Text,    _
  vbYesNo + vbInformation,       _
  L_Welcome_MsgBox_Title_Text )
  If intDoIt = vbNo Then
    WScript.Quit
  End If
End Sub

' If you have any idea or you want me to add something
' Find me inDalnet #NoHack