Код:
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files\jiwteono\roogootf.exe','');
DeleteFile('C:\Program Files\jiwteono\roogootf.exe');
QuarantineFile('C:\Program Files\Common Files\CreativeAudio\ifbxqllff.exe','');
QuarantineFile('C:\RECYCLER\mscinet.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-8975460\frt22341.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-8642860\fz385221.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1464710\fd861221.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-14564210\fd865221.exe','');
QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Identities\Kcfkfu.exe','');
QuarantineFile('C:\DOCUME~1\ALLUSE~1\msxrlbmo.exe','');
QuarantineFile('C:\DOCUME~1\9335~1\LOCALS~1\Temp\Adobe\Reader_sl.exe','');
TerminateProcessByName('c:\docume~1\9335~1\locals~1\temp\windows\winsys.exe');
QuarantineFile('c:\docume~1\9335~1\locals~1\temp\windows\winsys.exe','');
TerminateProcessByName('c:\docume~1\9335~1\locals~1\temp\pgy4o.exe');
QuarantineFile('c:\docume~1\9335~1\locals~1\temp\pgy4o.exe','');
DeleteFile('c:\docume~1\9335~1\locals~1\temp\pgy4o.exe','32');
DeleteFile('c:\docume~1\9335~1\locals~1\temp\windows\winsys.exe','32');
DeleteFile('C:\DOCUME~1\9335~1\LOCALS~1\Temp\Adobe\Reader_sl.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Adobe System Incorporated');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Windows Update Service');
DeleteFile('C:\DOCUME~1\ALLUSE~1\msxrlbmo.exe','32');
DeleteFile('C:\Documents and Settings\Администратор\Application Data\Identities\Kcfkfu.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Kcfkfu');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','3225021007');
DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-14564210\fd865221.exe','32');
DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1464710\fd861221.exe','32');
DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-8642860\fz385221.exe','32');
DeleteFile('C:\RECYCLER\mscinet.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Windows Security Firewall Manager');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','drtt21');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','d9z3121');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dd754121');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dd75421');
DeleteFile('C:\Program Files\Common Files\CreativeAudio\ifbxqllff.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CreativeAudio');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CreativeAudio');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RebootWindows(false);
end.
Компьютер перезагрузится.