'this script is to restore the damaged/modified registry by the w32sohanad worm.

this code may be freely distributed/modified.

'prevents errors from values that don't exist

on error resume next

set wshshell = wscript.createobject("wscript.shell")

'delete the keys that has disabled the windows registry tools and task manager.
wshshell.regdelete
"hkcu\software\microsoft\windows\currentversion\policies\system\disableregistrytoo
ls"
wshshell.regdelete
"hkcu\software\microsoft\windows\currentversion\policies\system\disabletaskmgr"
wshshell.regdelete
"hku\.default\software\microsoft\windows\currentversion\policies\system\disablereg
istrytools"
wshshell.regdelete
"hku\.default\software\microsoft\windows\currentversion\policies\system\disabletas
kmgr"

'delete the registry keys that changes your yahoo messenger status
wshshell.regdelete "hkcu\software\yahoo\pager\view\ymsgr_buzz\content url"
wshshell.regdelete "hkcu\software\yahoo\pager\view\ymsgr_launchcast\content url"

'delete the entries which make the worm start up while booting.
wshshell.regdelete "hklm\software\microsoft\windows\currentversion\run\task
manager"
wshshell.regdelete "hklm\software\microsoft\windows\currentversion\run\svchost"

'delete disable homepage buttons in ie

wshshell.regdelete "hkcu\software\policies\microsoft\internet explorer\control
panel\homepage"

'reset homepage
wshshell.regwrite "hkcu\software\microsoft\internet explorer\main\start page",
"about:blank", "reg_sz"

'reset ie title bar

wshshell.regwrite "hkcu\software\microsoft\internet explorer\main\window title",
"microsoft internet explorer"

x = msgbox("registry successfuly restored from the damage made by w32sohanad

worm", vbokonly, "success!!!")