Код:
begin
TerminateProcessByName('c:\users\charlie\appdata\local\amigo\application\amigo.exe');
TerminateProcessByName('c:\users\charlie\appdata\local\amigo\application\45.0.2454.107\amigo_cr.exe');
TerminateProcessByName('c:\program files (x86)\03000200-1452729122-0500-0006-000700080009\knsz93a3.tmp');
TerminateProcessByName('C:\Program Files (x86)\kingsoft\ksdef\ksdef64.exe');
TerminateProcessByName('c:\program files (x86)\kingsoft\ksdef\ksdefserver.exe');
TerminateProcessByName('c:\program files (x86)\kingsoft\ksdef\kshm.exe');
TerminateProcessByName('c:\users\charlie\appdata\local\temp\nshae4e.tmp');
TerminateProcessByName('c:\users\charlie\appdata\local\temp\nsn6b35.tmp');
TerminateProcessByName('c:\programdata\tmp0x0x\protectwindowsmanager.exe');
TerminateProcessByName('c:\users\charlie\appdata\local\03000200-1453067547-0500-0006-000700080009\qnscdf2a.tmp');
TerminateProcessByName('c:\program files (x86)\sunnyday3\sunnyday.exe');
TerminateProcessByName('c:\users\charlie\appdata\local\gmsd_ru_005010210\upgmsd_ru_005010210.exe');
TerminateProcessByName('c:\users\charlie\appdata\local\sunnyday3\usun.exe');
TerminateProcessByName('c:\programdata\2wdm2\wdman.exe');
StopService('DefSrv');
StopService('WdMan');
StopService('WindowsMangerProtect');
StopService('zigipyro');
StopService('61CBC97');
QuarantineFileF('C:\Program Files (x86)\kingsoft', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('c:\programdata\tmp0x0x', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\sunnyday3', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('c:\users\charlie\appdata\local\sunnyday3', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('c:\programdata\2wdm2', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Users\Charlie\AppData\Roaming\baidu', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files\UBar', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\Common Update', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('D:\Program Files (x86)\Tencent', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Users\Charlie\AppData\Roaming\ASPackage', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files\SpaceSoundPro', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Users\Charlie\AppData\Local\Tudou', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\AnyProtectEx', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\IObit', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('G:\Program Files (x86)\MPC Cleaner', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Users\Charlie\AppData\Roaming\sweet-page', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Users\Charlie\AppData\Roaming\yoursearching', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\MPC Cleaner', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 , 0);
QuarantineFile('c:\users\charlie\appdata\local\amigo\application\amigo.exe', '');
QuarantineFile('c:\users\charlie\appdata\local\amigo\application\45.0.2454.107\amigo_cr.exe', '');
QuarantineFile('c:\program files (x86)\03000200-1452729122-0500-0006-000700080009\knsz93a3.tmp', '');
QuarantineFile('C:\Program Files (x86)\kingsoft\ksdef\ksdef64.exe', '');
QuarantineFile('c:\program files (x86)\kingsoft\ksdef\ksdefserver.exe', '');
QuarantineFile('c:\program files (x86)\kingsoft\ksdef\kshm.exe', '');
QuarantineFile('c:\users\charlie\appdata\local\temp\nshae4e.tmp', '');
QuarantineFile('c:\users\charlie\appdata\local\temp\nsn6b35.tmp', '');
QuarantineFile('c:\programdata\tmp0x0x\protectwindowsmanager.exe', '');
QuarantineFile('c:\users\charlie\appdata\local\03000200-1453067547-0500-0006-000700080009\qnscdf2a.tmp', '');
QuarantineFile('c:\program files (x86)\sunnyday3\sunnyday.exe', '');
QuarantineFile('c:\users\charlie\appdata\local\gmsd_ru_005010210\upgmsd_ru_005010210.exe', '');
QuarantineFile('c:\users\charlie\appdata\local\sunnyday3\usun.exe', '');
QuarantineFile('c:\programdata\2wdm2\wdman.exe', '');
QuarantineFile('C:\Program Files (x86)\kingsoft\ksdef\kis3rdhmpg.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome_elf.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome_child.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\libglesv2.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\libegl.dll', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\YunUtilityService.exe', '');
QuarantineFile('C:\Program Files\UBar\UbarService.exe', '');
QuarantineFile('C:\Program Files (x86)\Common Update\vmserve Update\vmserve.exe', '');
QuarantineFile('C:\Program Files (x86)\03000200-1452729122-0500-0006-000700080009\hnsc6CC8.tmp', '');
QuarantineFile('C:\Program Files (x86)\03000200-1452729122-0500-0006-000700080009\jnsx5495.tmp', '');
QuarantineFile('D:\Program Files (x86)\Tencent\QQPCMgr\11.0.16779.224\QMUdisk64.sys', '');
QuarantineFile('C:\Program Files\UBar\UbarDriver.sys', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\gmsd_ru_005010210\usun.exe', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\ASPackage\ASPackage.exe', '');
QuarantineFile('C:\ProgramData\Tmp0x0x\P', '');
QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\YunDetectService.exe', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Temp\utt3C09.tmp.exe', '');
QuarantineFile('C:\ProgramData\JuReBeNk\jjgZSHwTuhWTb0.bat', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\clpWMFFqKdyxq\wIWrMxGBAgl1.bat', '');
QuarantineFile('C:\Users\Charlie\AppData\Local\Tudou\FeisuTudou\tudouDetector.dll', '');
QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '');
QuarantineFile('C:\Program Files (x86)\IObit\Advanced', '');
QuarantineFile('C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe', '');
QuarantineFile('C:\Program Files (x86)\Common Update\task Update\task.exe', '');
QuarantineFile('C:\Program Files (x86)\IObit\IObit', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\sweet-page\UninstallManager.exe', '');
QuarantineFile('C:\Users\Charlie\AppData\Roaming\yoursearching\UninstallManager.exe', '');
QuarantineFile('C:\Program Files (x86)\MPC Cleaner\Uninstall.exe', '');
QuarantineFile('C:\Users\Charlie\appdata\roaming\aspackage\uninstall.exe', '');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64');
DeleteFile('c:\users\charlie\appdata\local\amigo\application\amigo.exe', '32');
DeleteFile('c:\users\charlie\appdata\local\amigo\application\45.0.2454.107\amigo_cr.exe', '32');
DeleteFile('c:\program files (x86)\03000200-1452729122-0500-0006-000700080009\knsz93a3.tmp', '32');
DeleteFile('C:\Program Files (x86)\kingsoft\ksdef\ksdef64.exe', '32');
DeleteFile('c:\program files (x86)\kingsoft\ksdef\ksdefserver.exe', '32');
DeleteFile('c:\program files (x86)\kingsoft\ksdef\kshm.exe', '32');
DeleteFile('c:\users\charlie\appdata\local\temp\nshae4e.tmp', '32');
DeleteFile('c:\users\charlie\appdata\local\temp\nsn6b35.tmp', '32');
DeleteFile('c:\programdata\tmp0x0x\protectwindowsmanager.exe', '32');
DeleteFile('c:\users\charlie\appdata\local\03000200-1453067547-0500-0006-000700080009\qnscdf2a.tmp', '32');
DeleteFile('c:\program files (x86)\sunnyday3\sunnyday.exe', '32');
DeleteFile('c:\users\charlie\appdata\local\gmsd_ru_005010210\upgmsd_ru_005010210.exe', '32');
DeleteFile('c:\users\charlie\appdata\local\sunnyday3\usun.exe', '32');
DeleteFile('c:\programdata\2wdm2\wdman.exe', '32');
DeleteFile('C:\Program Files (x86)\kingsoft\ksdef\kis3rdhmpg.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome_elf.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\chrome_child.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\libglesv2.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Amigo\Application\45.0.2454.107\libegl.dll', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\YunUtilityService.exe', '32');
DeleteFile('C:\Program Files\UBar\UbarService.exe', '32');
DeleteFile('C:\Program Files (x86)\Common Update\vmserve Update\vmserve.exe', '32');
DeleteFile('C:\Program Files (x86)\03000200-1452729122-0500-0006-000700080009\hnsc6CC8.tmp', '32');
DeleteFile('C:\Program Files (x86)\03000200-1452729122-0500-0006-000700080009\jnsx5495.tmp', '32');
DeleteFile('C:\Windows\TEMP\61CBC97.sys', '32');
DeleteFile('D:\Program Files (x86)\Tencent\QQPCMgr\11.0.16779.224\QMUdisk64.sys', '32');
DeleteFile('C:\Program Files\UBar\UbarDriver.sys', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\gmsd_ru_005010210\usun.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\ASPackage\ASPackage.exe', '32');
DeleteFile('C:\ProgramData\Tmp0x0x\P', '32');
DeleteFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\YunDetectService.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\baidu\BaiduYunGuanjia\BaiduYunGuanjia.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Temp\utt3C09.tmp.exe', '32');
DeleteFile('C:\ProgramData\JuReBeNk\jjgZSHwTuhWTb0.bat', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\clpWMFFqKdyxq\wIWrMxGBAgl1.bat', '32');
DeleteFile('C:\Users\Charlie\AppData\Local\Tudou\FeisuTudou\tudouDetector.dll', '32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32');
DeleteFile('C:\Program Files (x86)\IObit\Advanced', '32');
DeleteFile('C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe', '32');
DeleteFile('C:\Program Files (x86)\Common Update\task Update\task.exe', '32');
DeleteFile('C:\Program Files (x86)\IObit\IObit', '32');
DeleteFile('G:\Program Files (x86)\MPC Cleaner\Uninstall.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\sweet-page\UninstallManager.exe', '32');
DeleteFile('C:\Users\Charlie\AppData\Roaming\yoursearching\UninstallManager.exe', '32');
DeleteFile('C:\Program Files (x86)\MPC Cleaner\Uninstall.exe', '32');
DeleteFile('C:\Users\Charlie\appdata\roaming\aspackage\uninstall.exe', '32');
DeleteService('DefSrv');
DeleteService('WdMan');
DeleteService('WindowsMangerProtect');
DeleteService('zigipyro');
DeleteService('BaiduYunUtility');
DeleteService('UbarPolicyProvider');
DeleteService('vmserve');
DeleteService('wucotusy');
DeleteService('zutuzuni');
DeleteService('61CBC97');
DeleteService('QMUdisk');
DeleteService('UbarCalloutDriver');
DeleteFileMask('c:\users\charlie\appdata\local\amigo', '*', true);
DeleteFileMask('C:\Program Files (x86)\kingsoft', '*', true);
DeleteFileMask('c:\programdata\tmp0x0x', '*', true);
DeleteFileMask('c:\program files (x86)\sunnyday3', '*', true);
DeleteFileMask('c:\users\charlie\appdata\local\sunnyday3', '*', true);
DeleteFileMask('c:\programdata\2wdm2', '*', true);
DeleteFileMask('C:\Users\Charlie\AppData\Roaming\baidu', '*', true);
DeleteFileMask('C:\Program Files\UBar', '*', true);
DeleteFileMask('C:\Program Files (x86)\Common Update', '*', true);
DeleteFileMask('D:\Program Files (x86)\Tencent', '*', true);
DeleteFileMask('C:\Users\Charlie\AppData\Roaming\ASPackage', '*', true);
DeleteFileMask('C:\Program Files\SpaceSoundPro', '*', true);
DeleteFileMask('C:\Users\Charlie\AppData\Local\Tudou', '*', true);
DeleteFileMask('C:\Program Files (x86)\AnyProtectEx', '*', true);
DeleteFileMask('C:\Program Files (x86)\IObit', '*', true);
DeleteFileMask('G:\Program Files (x86)\MPC Cleaner', '*', true);
DeleteFileMask('C:\Users\Charlie\AppData\Roaming\sweet-page', '*', true);
DeleteFileMask('C:\Users\Charlie\AppData\Roaming\yoursearching', '*', true);
DeleteFileMask('C:\Program Files (x86)\MPC Cleaner', '*', true);
DeleteDirectory('c:\users\charlie\appdata\local\amigo');
DeleteDirectory('C:\Program Files (x86)\kingsoft');
DeleteDirectory('c:\programdata\tmp0x0x');
DeleteDirectory('c:\program files (x86)\sunnyday3');
DeleteDirectory('c:\users\charlie\appdata\local\sunnyday3');
DeleteDirectory('c:\programdata\2wdm2');
DeleteDirectory('C:\Users\Charlie\AppData\Roaming\baidu');
DeleteDirectory('C:\Program Files\UBar');
DeleteDirectory('C:\Program Files (x86)\Common Update');
DeleteDirectory('D:\Program Files (x86)\Tencent');
DeleteDirectory('C:\Users\Charlie\AppData\Roaming\ASPackage');
DeleteDirectory('C:\Program Files\SpaceSoundPro');
DeleteDirectory('C:\Users\Charlie\AppData\Local\Tudou');
DeleteDirectory('C:\Program Files (x86)\AnyProtectEx');
DeleteDirectory('C:\Program Files (x86)\IObit');
DeleteDirectory('G:\Program Files (x86)\MPC Cleaner');
DeleteDirectory('C:\Users\Charlie\AppData\Roaming\sweet-page');
DeleteDirectory('C:\Users\Charlie\AppData\Roaming\yoursearching');
DeleteDirectory('C:\Program Files (x86)\MPC Cleaner');
DelBHO('{43BEAFD9-E005-483D-A367-146BA6C8A32E}');
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "ASC9_PerformanceMonitor" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "ASC9_SkipUac_Charlie" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "task Update" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Uninstaller_SkipUac_Charlie" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{1CBC62EE-4AD5-43D4-86E8-A27A71337F93}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{385BD6EE-9724-4534-AD54-04581C25A3F8}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{5451D762-A50F-4998-9D41-4863E0D84AB3}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{E09C9870-C6AB-4B57-BFCC-04B2B8805FBD}" /F', 0, 15000, true);
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'usun.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'upgmsd_ru_005010210.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'Update');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SpaceSoundPro');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BaiduYunDetect', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BaiduYunGuanjia', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent', 'command');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.