Троянский конь [Trojan-Downloader.Win32.Agent.heqj, not-a-virus:NetTool.Win64.NetFilter.a ]

[Елена Андрякова]

Включил компьютер и обнаружил, что на нём все файлы были переименованы в длинные названия с расширением .XTBL. На рабочем столе на чёрном фоне красным написано – Все важные файлы на всех дисках вашего компьютера были зашифрованы. Подробности вы можете прочитать в файлах README.txt, которые можно найти на всех дисках. Помогите

[Info_bot]

Уважаемый(ая) Елена Андрякова, спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[olejah]

Выполните скрипт в АВЗ:

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
  then
   begin
    SearchRootkit(true, true);
    SetAVZGuardStatus(true);
   end;
 SetServiceStart('sysmon', 4);
 SetServiceStart('storegidfilter', 4);
 SetServiceStart('ssnfd', 4);
 SetServiceStart('SPBIUpdd', 4);
 SetServiceStart('screentk', 4);
 SetServiceStart('rsutils', 4);
 SetServiceStart('bd0002', 4);
 SetServiceStart('bd0004', 4);
 SetServiceStart('BDDefense', 4);
 SetServiceStart('SPBIUpd', 4);
 TerminateProcessByName('c:\users\Администратор\appdata\roaming\ssleas.exe');
 TerminateProcessByName('C:\Program Files\Common Files\ShopperPro\spbiu.exe');
 TerminateProcessByName('c:\users\Администратор\appdata\local\kometa\kometaup.exe');
 TerminateProcessByName('c:\users\Администратор\appdata\roaming\getnowupdater\bin\getnowupdater.exe');
 TerminateProcessByName('c:\program files (x86)\cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.exe');
 TerminateProcessByName('c:\programdata\windows\csrss.exe');
 TerminateProcessByName('c:\users\Администратор\appdata\roaming\cppredistx86.exe');
 TerminateProcessByName('c:\program files (x86)\hd-v2.2v08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.exe');
QuarantineFileF('C:\Program Files (x86)\Object Browser', '*.*', true,'', 0, 0, '', '');
 QuarantineFile('C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe','');
QuarantineFile('C:\Program Files (x86)\Microsoft Data\nsi.exe',''); 
QuarantineFile('C:\Users\Администратор\appdata\roaming\digitalsites\updateproc\updatetask.exe','');
 QuarantineFile('C:\Windows\syswow64\nethtsrv.exe','');
 QuarantineFile('C:\Windows\syswow64\hfpapi.dll','');
 QuarantineFile('C:\Windows\syswow64\hfnapi.dll','');
 QuarantineFile('C:\Windows\system32\netupdsrv.exe','');
 QuarantineFile('C:\Windows\system32\nethtsrv.exe','');
 QuarantineFile('C:\Windows\system32\hfpapi.dll','');
 QuarantineFile('C:\Windows\system32\hfnapi.dll','');
 QuarantineFile('D:\fmxa.pif','');
 QuarantineFile('D:\autorun.inf','');
 QuarantineFile('C:\autorun.inf','');
 QuarantineFile('C:\efvuyn.exe','');
 QuarantineFile('c:\users\Администратор\appdata\local\kometa\application\kometa.exe','');
 QuarantineFile('C:\Program Files (x86)\YTDownloader\updater.exe','');
 QuarantineFile('C:\ProgramData\ShopperPro\spbihe.js','');
 QuarantineFile('C:\PROGRA~1\COMMON~1\System\SysMenu.dll','');
 QuarantineFile('C:\Program Files (x86)\ShopperPro\updater.exe','');
 QuarantineFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\newSI_611\s_inst.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\newSI_5\s_inst.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\newSI_4\s_inst.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\newSI_3\s_inst.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\IWACPOX.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\HU.exe','');
 QuarantineFile('C:\Users\836D~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-7.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-5.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-4.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-2.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-11.exe','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\Cinemax-codedownloader.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-7.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-6.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-5.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-4.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-2.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-11.exe','');
 QuarantineFile('C:\Program Files (x86)\iWebar\iWebar-codedownloader.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\BTBD.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\22717\Updater.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-7.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-5.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-4.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-3.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-2.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\HD-V2.2V08.11-codedownloader.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-11.exe','');
 QuarantineFile('C:\ProgramData\ShopperPro\ShopperPro.dll','');
 QuarantineFile('C:\Program Files (x86)\SearchSnacks\IE\SearchSnacksClientIE.dll','');
 QuarantineFile('C:\Program Files (x86)\Аудио и видео скачивание\IE\x86\Downloader.dll','');
 QuarantineFile('C:\Program Files (x86)\BuyNsave\u8M4Qva7u7BIx3.dll','');
 QuarantineFile('C:\Program Files (x86)\tooldev342\Weatherbar\TracersToolbarBHO_x86.dll','');
 QuarantineFile('C:\Program Files (x86)\YoutubeAdBlocke\WiLGAbeV9rO9pU.dll','');
 QuarantineFile('C:\Program Files (x86)\iWebar\iWebar-bho.dll','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\HD-V2.2V08.11-bho.dll','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\Cinemax-bho.dll','');
 QuarantineFile('C:\Program Files (x86)\Object Browser\Object Browser-bho.dll','');
 QuarantineFile('C:\Program Files (x86)\DolkaRuIePlugin\TinyBHO.dll','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\cppredistx86.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\eTranslator\eTranslator.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Roaming\TheAnswerFinder\TheAnswerFinder.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\storegid\storegidup.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\storegid\storegid.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\screentk\screentoolkit.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\screentk\screentool.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\screentk\screentkup.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Microsoft\Windows\system.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Microsoft\Extensions\safebrowser.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Mail.ru\Sputnik\ptls\mailruhomesearchvbm.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Mail.ru\Sputnik\ptls\UU9O3pRLyrwV.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Kometa\kometaup.exe','');
 QuarantineFile('C:\Users\Администратор\AppData\Local\Kometa\Application\kometa.exe','');
 QuarantineFile('C:\Users\1\AppData\Local\ConvertAd\ConvertAd.exe','');
 QuarantineFile('C:\ProgramData\Schedule\timetasks.exe','');
 QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\edAjHzxLLw++NUKYofQwc5D+dUIjbhW7Vpld4oBpbCw=.xtbl','');
 QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','');
 QuarantineFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','');
 QuarantineFile('C:\Program Files (x86)\Twilight Tech\Pretty Search\dummyDlg.exe','');
 QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.1397\jsdrv.exe','');
 QuarantineFile('C:\Program Files (x86)\Kinoroom Browser\kinoroom-browser.exe.bat','');
 QuarantineFile('C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll','');
 QuarantineFile('C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll','');
 QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.1397\jsdrv.sys','');
 QuarantineFile('C:\PROGRA~2\YTDOWN~1\sbmntr.sys','');
 QuarantineFile('C:\Windows\system32\DRIVERS\sysmon.sys','');
 QuarantineFile('C:\Program Files (x86)\Mega Browse\bin\utilMegaBrowse.exe','');
 QuarantineFile('C:\Program Files (x86)\Mega Browse\updateMegaBrowse.exe','');
 QuarantineFile('C:\Program Files (x86)\SearchSnacks\Service\sssvc.exe','');
 QuarantineFile('C:\Program Files\Common Files\ShopperPro\spbiu.exe','');
 QuarantineFile('C:\Windows\system32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys','');
 QuarantineFile('C:\Windows\storegidfilter.sys','');
 QuarantineFile('C:\Windows\system32\drivers\ssnfd.sys','');
 QuarantineFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys','');
 QuarantineFile('C:\Windows\screentk.sys','');
 QuarantineFile('c:\program files (x86)\hd-v2.2v08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.exe','');
 QuarantineFile('c:\users\Администратор\appdata\roaming\cppredistx86.exe','');
 QuarantineFile('c:\programdata\windows\csrss.exe','');
 QuarantineFile('c:\program files (x86)\cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.exe','');
 QuarantineFile('c:\users\Администратор\appdata\roaming\getnowupdater\bin\getnowupdater.exe','');
 QuarantineFile('c:\users\Администратор\appdata\local\kometa\kometaup.exe','');
 QuarantineFile('c:\users\Администратор\appdata\roaming\ssleas.exe','');
 QuarantineFile('C:\Program Files (x86)\HD-V2.2V08.11\12cad0da-6480-46ad-9bc3-b1ca7b4b2cc7.dll','');
 QuarantineFile('C:\Program Files (x86)\Cinemax\37b44cdf-01c4-4fde-979a-0b089abcc7c6.dll','');
 DeleteFile('C:\Program Files (x86)\Cinemax\37b44cdf-01c4-4fde-979a-0b089abcc7c6.dll','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\12cad0da-6480-46ad-9bc3-b1ca7b4b2cc7.dll','32');
 DeleteFile('c:\users\Администратор\appdata\roaming\ssleas.exe','32');
 DeleteFile('c:\users\Администратор\appdata\local\kometa\kometaup.exe','32');
 DeleteFile('c:\users\Администратор\appdata\roaming\getnowupdater\bin\getnowupdater.exe','32');
 DeleteFile('c:\program files (x86)\cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.exe','32');
 DeleteFile('c:\programdata\windows\csrss.exe','32');
 DeleteFile('c:\users\Администратор\appdata\roaming\cppredistx86.exe','32');
 DeleteFile('c:\program files (x86)\hd-v2.2v08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.exe','32');
 DeleteFile('C:\Windows\system32\DRIVERS\bd0002.sys','32');
 DeleteFile('C:\Windows\system32\DRIVERS\bd0004.sys','32');
 DeleteFile('C:\Windows\system32\drivers\BDDefense.sys','32');
 DeleteFile('C:\Windows\screentk.sys','32');
 DeleteFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys','32');
 DeleteFile('C:\Windows\system32\drivers\ssnfd.sys','32');
 DeleteFile('C:\Windows\storegidfilter.sys','32');
 DeleteFile('C:\Windows\system32\DRIVERS\sysmon.sys','32');
 DeleteFile('C:\Windows\system32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys','32');
 DeleteFile('C:\Program Files\Common Files\ShopperPro\spbiu.exe','32');
 DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BaiduHips.exe','32');
 DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\3.0.0.3971\baiduAnSvc.exe','32');
 DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduProtect1.3\1.3.0.635\BaiduProtect.exe','32');
 DeleteFile('C:\Program Files (x86)\SearchSnacks\Service\sssvc.exe','32');
 DeleteFile('C:\Program Files (x86)\Mega Browse\updateMegaBrowse.exe','32');
 DeleteFile('C:\Program Files (x86)\Mega Browse\bin\utilMegaBrowse.exe','32');
 DeleteFile('C:\Windows\system32\DRIVERS\rsutils.sys','32');
 DeleteFile('C:\Windows\system32\DRIVERS\BDAntiExp.sys','32');
 DeleteFile('C:\Windows\system32\drivers\BDEnhanceBoost.sys','32');
 DeleteFile('C:\Windows\system32\DRIVERS\BDMNetMon.sys','32');
 DeleteFile('C:\Windows\system32\DRIVERS\BDMWrench_x64.sys','32');
 DeleteFile('C:\PROGRA~2\YTDOWN~1\sbmntr.sys','32');
 DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.1397\jsdrv.sys','32');
 DeleteFile('C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll','32');
 DeleteFile('C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll','32');
 DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe','32');
 DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtectTray.exe','32');
 DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\3.0.0.3971\baiduAnTray.exe','32');
 DeleteFile('C:\Program Files (x86)\Kinoroom Browser\kinoroom-browser.exe.bat','32');
 DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.1397\jsdrv.exe','32');
 DeleteFile('C:\Program Files (x86)\Twilight Tech\Pretty Search\dummyDlg.exe','32');
 DeleteFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','32');
 DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','32');
 DeleteFile('C:\Program Files (x86)\baidu\BindEx.exe','32');
 DeleteFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\edAjHzxLLw++NUKYofQwc5D+dUIjbhW7Vpld4oBpbCw=.xtbl','32');
 DeleteFile('C:\ProgramData\Schedule\timetasks.exe','32');
 DeleteFile('C:\Users\1\AppData\Local\ConvertAd\ConvertAd.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Kometa\Application\kometa.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Baidu\Baidu\1.3.1.157\Baidu.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Kometa\kometaup.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Mail.ru\Sputnik\ptls\UU9O3pRLyrwV.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Microsoft\Extensions\safebrowser.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\Microsoft\Windows\system.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\screentk\screentkup.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\screentk\screentool.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\screentk\screentoolkit.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\storegid\storegid.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\storegid\storegidup.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\TheAnswerFinder\TheAnswerFinder.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\eTranslator\eTranslator.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\cppredistx86.exe','32');
 DeleteFile('C:\Program Files (x86)\DolkaRuIePlugin\TinyBHO.dll','32');
 DeleteFile('C:\Program Files (x86)\Object Browser\Object Browser-bho.dll','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\Cinemax-bho.dll','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\HD-V2.2V08.11-bho.dll','32');
 DeleteFile('C:\Program Files (x86)\iWebar\iWebar-bho.dll','32');
 DeleteFile('C:\Program Files (x86)\YoutubeAdBlocke\WiLGAbeV9rO9pU.dll','32');
 DeleteFile('C:\Program Files (x86)\tooldev342\Weatherbar\TracersToolbarBHO_x86.dll','32');
 DeleteFile('C:\Program Files (x86)\BuyNsave\u8M4Qva7u7BIx3.dll','32');
 DeleteFile('C:\Program Files (x86)\Аудио и видео скачивание\IE\x86\Downloader.dll','32');
 DeleteFile('C:\Program Files (x86)\SearchSnacks\IE\SearchSnacksClientIE.dll','32');
 DeleteFile('C:\ProgramData\ShopperPro\ShopperPro.dll','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-11.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\HD-V2.2V08.11-codedownloader.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-2.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-3.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-4.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-5.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.exe','32');
 DeleteFile('C:\Program Files (x86)\HD-V2.2V08.11\5924c8f8-ea73-4380-ad2c-79248ef3df7e-7.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Local\22717\Updater.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\BTBD.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\iWebar-codedownloader.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-11.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-2.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-4.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-5.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-6.exe','32');
 DeleteFile('C:\Program Files (x86)\iWebar\ce30dd40-0eaa-4696-9710-a9eedaf5857d-7.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\Cinemax-codedownloader.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-11.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-2.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-4.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-5.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.exe','32');
 DeleteFile('C:\Program Files (x86)\Cinemax\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-7.exe','32');
 DeleteFile('C:\Users\836D~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\HU.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\IWACPOX.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\newSI_3\s_inst.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\newSI_4\s_inst.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\newSI_5\s_inst.exe','32');
 DeleteFile('C:\Users\Администратор\AppData\Roaming\newSI_611\s_inst.exe','32');
 DeleteFile('C:\Program Files (x86)\Rising\RZC\rsdelaylauncher.exe','32');
 DeleteFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe','32');
 DeleteFile('C:\Program Files (x86)\ShopperPro\updater.exe','32');
 DeleteFile('spbiu.exe','32');
 DeleteFile('C:\ProgramData\ShopperPro\spbihe.js','32');
 DeleteFile('C:\Program Files (x86)\YTDownloader\updater.exe','32');
 DeleteFile('c:\users\Администратор\appdata\local\kometa\application\kometa.exe','32');
 DeleteFile('C:\efvuyn.exe','32');
 DeleteFile('C:\autorun.inf','32');
 DeleteFile('D:\autorun.inf','32');
 DeleteFile('D:\fmxa.pif','32');
 DeleteFile('C:\Windows\system32\hfnapi.dll','32');
 DeleteFile('C:\Windows\system32\hfpapi.dll','32');
 DeleteFile('C:\Windows\system32\nethtsrv.exe','32');
 DeleteFile('C:\Windows\system32\netupdsrv.exe','32');
 DeleteFile('C:\Windows\syswow64\hfnapi.dll','32');
 DeleteFile('C:\Windows\syswow64\hfpapi.dll','32');
 DeleteFile('C:\Windows\syswow64\nethtsrv.exe','32');
 DeleteFile('C:\Users\Администратор\appdata\roaming\digitalsites\updateproc\updatetask.exe','32');
 DeleteFile('C:\Program Files (x86)\PC Speed Up\PCSUService.exe','32');
 DeleteFile('C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe','32');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-1.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-11.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-2.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-3.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-4.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-5.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-5_user.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-6.job','64');
 DeleteFile('C:\Windows\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-7.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-1.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-11.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-2.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-3.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-4.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-5.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-5_user.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6.job','64');
 DeleteFile('C:\Windows\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-7.job','64');
 DeleteFile('C:\Windows\Tasks\AmiUpdXp.job','64');
 DeleteFile('C:\Windows\Tasks\BTBD.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-1.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-11.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-2.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-4.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-5.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-5_user.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-6.job','64');
 DeleteFile('C:\Windows\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-7.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-1.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-11.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-2.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-4.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-5.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-5_user.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6.job','64');
 DeleteFile('C:\Windows\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-7.job','64');
 DeleteFile('C:\Windows\Tasks\DAWRJ.job','64');
 DeleteFile('C:\Windows\Tasks\Digital Sites.job','64');
 DeleteFile('C:\Windows\Tasks\HU.job','64');
 DeleteFile('C:\Windows\Tasks\IWACPOX.job','64');
 DeleteFile('C:\Windows\Tasks\newSI_3.job','64');
 DeleteFile('C:\Windows\Tasks\newSI_4.job','64');
 DeleteFile('C:\Windows\Tasks\newSI_5.job','64');
 DeleteFile('C:\Windows\Tasks\newSI_611.job','64');
 DeleteFile('C:\Windows\Tasks\PC SpeedUp Service Deactivator.job','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-1','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-11','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-2','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-3','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-4','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-5','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-6','64');
 DeleteFile('C:\Windows\system32\Tasks\20df0c7f-aa01-41d0-8f53-1bfb00210e24-7','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-1','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-11','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-2','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-3','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-4','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-5','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-6','64');
 DeleteFile('C:\Windows\system32\Tasks\5924c8f8-ea73-4380-ad2c-79248ef3df7e-7','64');
 DeleteFile('C:\Windows\system32\Tasks\AmiUpdXp','64');
 DeleteFile('C:\Windows\system32\Tasks\BonanzaDealsUpdate','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-1','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-11','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-2','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-4','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-5','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-6','64');
 DeleteFile('C:\Windows\system32\Tasks\ce30dd40-0eaa-4696-9710-a9eedaf5857d-7','64');
 DeleteFile('C:\Windows\system32\Tasks\chrome5_logon','64');
 DeleteFile('C:\Program Files (x86)\Microsoft Data\nsi.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-1','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-11','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-2','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-4','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-5','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-6','64');
 DeleteFile('C:\Windows\system32\Tasks\d69a8b54-bf64-4400-bcf0-fcdd6bf83348-7','64');
 DeleteFile('C:\Windows\system32\Tasks\extsetup','64');
 DeleteFile('C:\Windows\system32\Tasks\Kbupdater Utility','64');
 DeleteFile('C:\Windows\system32\Tasks\Kinoroom Browser','64');
 DeleteFile('C:\Windows\system32\Tasks\newSI_3','64');
 DeleteFile('C:\Windows\system32\Tasks\newSI_4','64');
 DeleteFile('C:\Windows\system32\Tasks\newSI_5','64');
 DeleteFile('C:\Windows\system32\Tasks\newSI_611','64');
 DeleteFile('C:\Windows\system32\Tasks\PC SpeedUp Service Deactivator','64');
 DeleteFile('C:\Windows\system32\Tasks\Safebrowser','64');
 DeleteFile('C:\Windows\system32\Tasks\ShopperPro','64');
 DeleteFile('C:\Windows\system32\Tasks\ShopperProJSUpd','64');
 DeleteFile('C:\Windows\system32\Tasks\SPBIW_UpdateTask_Time_313439313637393334352d554a374134342d2a326c5b5a','64');
 DeleteFile('C:\Windows\system32\Tasks\SPDriver','64');
 DeleteFile('C:\Windows\system32\Tasks\SystemScript','64');
 DeleteFile('C:\Windows\system32\Tasks\YTDownloader','64');
 DeleteFile('C:\Windows\system32\Tasks\YTDownloaderUpd','64');
 DeleteFile('C:\Windows\system32\Tasks\{DCC356A8-A906-4CCD-9372-8367B78F833B}','64'); 
DelBHO('{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}');
 DelBHO('{7D1B27B2-3DE0-4F26-94A0-E14FDB06D292}');
 DelBHO('{4F3C10F8-9B89-4A2E-B523-33F2FB682DC2}');
 DelBHO('{1df0c3b1-468f-4fb2-939a-370848b03802}');
 DelBHO('{17177FAA-3830-43D3-A70B-FDE532676B1E}');
 DelBHO('{1144a2e1-e8c0-4d78-8a32-e540679d276b}');
 DelBHO('{11111111-1111-1111-1111-110611511123}');
 DelBHO('{11111111-1111-1111-1111-110611381131}');
 DelBHO('{11111111-1111-1111-1111-110611111195}');
 DelBHO('{11111111-1111-1111-1111-110311281150}');
 DelBHO('{00e71626-0bef-11dc-8314-0800200c9a66}');
 DeleteService('SPDRIVER_1.37.0.1397');
 DeleteService('sbmntr');
 DeleteService('BDMWrench_x64');
 DeleteService('BDMNetMon');
 DeleteService('BDEnhanceBoost');
 DeleteService('BDAntiExp');
 DeleteService('SPBIUpdd');
 DeleteService('sysmon');
 DeleteService('storegidfilter');
 DeleteService('ssnfd');
 DeleteService('screentk');
 DeleteService('rsutils');
 DeleteService('BDDefense');
 DeleteService('bd0004');
 DeleteService('bd0002');
 DeleteService('Util Mega Browse');
 DeleteService('Update Mega Browse');
 DeleteService('sssvc');
 DeleteService('CltMngSvc');
 DeleteService('BDSGRTP');
 DeleteService('BDMRTP');
 DeleteService('BaiduHips');
 DeleteService('SPBIUpd');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','AnyProtect Tray');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','AnyProtect');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','runrzc');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','PCSpeedUp');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SPDriver');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SPDriver');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','YTDownloader');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YTDownloader');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarLoader');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','baidu');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Schedule');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConvertAd');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','BaiduClient');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','KometaLaunchPanel');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','kometaup');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','UU9O3pRLyrwV');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SystemScript');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SystemScript');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','screentkUpdater');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','screentk');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','screentoolkit.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','storegid');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','storegidUpdater');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','GetNowUpdater');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','TheAnswerFinder');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Visual C++ 2010');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','eTranslator Update');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','BaiduClient');
DeleteFileMask('C:\Program Files\Common Files\ShopperPro', '*', true);
DeleteDirectory('C:\Program Files\Common Files\ShopperPro');
DeleteFileMask('c:\users\Администратор\appdata\local\kometa', '*', true);
DeleteDirectory('c:\users\Администратор\appdata\local\kometa');
DeleteFileMask('c:\users\Администратор\appdata\roaming\getnowupdater', '*', true);
DeleteDirectory('c:\users\Администратор\appdata\roaming\getnowupdater');
DeleteFileMask('c:\program files (x86)\cinemax', '*', true);
DeleteDirectory('c:\program files (x86)\cinemax');
DeleteFileMask('C:\Program Files (x86)\Microsoft Data', '*', true);
DeleteDirectory('C:\Program Files (x86)\Microsoft Data');
DeleteFileMask('c:\program files (x86)\hd-v2.2v08.11', '*', true);
DeleteDirectory('c:\program files (x86)\hd-v2.2v08.11');
DeleteFileMask('C:\Program Files (x86)\SearchProtect', '*', true);
DeleteDirectory('C:\Program Files (x86)\SearchProtect');
DeleteFileMask('C:\Users\Администратор\appdata\roaming\digitalsites', '*', true);
DeleteDirectory('C:\Users\Администратор\appdata\roaming\digitalsites');
DeleteFileMask('C:\Program Files (x86)\YTDownloader', '*', true);
DeleteDirectory('C:\Program Files (x86)\YTDownloader');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\newSI_611', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\newSI_611');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\newSI_5', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\newSI_5');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\newSI_4', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\newSI_4');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\newSI_3', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\newSI_3');
DeleteFileMask('C:\Program Files (x86)\PC Speed Up', '*', true);
DeleteDirectory('C:\Program Files (x86)\PC Speed Up');
DeleteFileMask('C:\Program Files (x86)\iWebar', '*', true);
DeleteDirectory('C:\Program Files (x86)\iWebar');
DeleteFileMask('C:\Program Files (x86)\Object Browser', '*', true);
DeleteDirectory('C:\Program Files (x86)\Object Browser');
DeleteFileMask('C:\ProgramData\ShopperPro', '*', true);
DeleteDirectory('C:\ProgramData\ShopperPro');
DeleteFileMask('C:\Program Files (x86)\ShopperPro', '*', true);
DeleteDirectory('C:\Program Files (x86)\ShopperPro');
DeleteFileMask('C:\Users\Администратор\AppData\Local\22717', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Local\22717');
DeleteFileMask('C:\Program Files (x86)\SearchSnacks', '*', true);
DeleteDirectory('C:\Program Files (x86)\SearchSnacks');
DeleteFileMask('C:\Program Files (x86)\Аудио и видео скачивание', '*', true);
DeleteDirectory('C:\Program Files (x86)\Аудио и видео скачивание');
DeleteFileMask('C:\Program Files (x86)\BuyNsave', '*', true);
DeleteDirectory('C:\Program Files (x86)\BuyNsave');
DeleteFileMask('C:\Program Files (x86)\tooldev342', '*', true);
DeleteDirectory('C:\Program Files (x86)\tooldev342');
DeleteFileMask('C:\ProgramData\Program status', '*', true);
DeleteDirectory('C:\ProgramData\Program status');
DeleteFileMask('C:\Program Files (x86)\YoutubeAdBlocke', '*', true);
DeleteDirectory('C:\Program Files (x86)\YoutubeAdBlocke');
DeleteFileMask('C:\Program Files (x86)\DolkaRuIePlugin', '*', true);
DeleteDirectory('C:\Program Files (x86)\DolkaRuIePlugin');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\eTranslator', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\eTranslator');
DeleteFileMask('C:\Users\Администратор\AppData\Roaming\TheAnswerFinder', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Roaming\TheAnswerFinder');
DeleteFileMask('C:\Users\Администратор\AppData\Local\storegid', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Local\storegid');
DeleteFileMask('C:\Users\Администратор\AppData\Local\screentk', '*', true);
DeleteDirectory('C:\Users\Администратор\AppData\Local\screentk');
DeleteFileMask('C:\Users\1\AppData\Local\ConvertAd', '*', true);
DeleteDirectory('C:\Users\1\AppData\Local\ConvertAd');
DeleteFileMask('C:\Program Files (x86)\Zaxar', '*', true);
DeleteDirectory('C:\Program Files (x86)\Zaxar');
DeleteFileMask('c:\programdata\schedule', '*', true);
DeleteDirectory('c:\programdata\schedule');
DeleteFileMask('C:\Program Files (x86)\Twilight Tech', '*', true);
DeleteDirectory('C:\Program Files (x86)\Twilight Tech');
DeleteFileMask('C:\Program Files (x86)\Kinoroom Browser', '*', true);
DeleteDirectory('C:\Program Files (x86)\Kinoroom Browser');
DeleteFileMask('C:\Program Files (x86)\Mega Browse', '*', true);
DeleteDirectory('C:\Program Files (x86)\Mega Browse');
 BC_ImportAll;    
ExecuteSysClean;
BC_Activate;
 RebootWindows(false);
end.

Пришлите карантин согласно Приложения 2 правил по красной ссылке Прислать запрошенный карантин вверху темы

Сделайте новые логи

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 39
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\program files (x86)\kinoroom browser\kinoroom-browser.exe.bat - Trojan-Clicker.BAT.Agent.an ( DrWEB: BAT.StartPage.42, AVAST4: BV:Runner-AN [Trj] )
  2. c:\program files\common files\shopperpro\spbiu.exe - not-a-virus:Downloader.NSIS.Agent.ri ( DrWEB: Adware.Siggen.31171 )
  3. c:\program files\common files\shopperpro\spbiw.sys - not-a-virus:Downloader.NSIS.Agent.ri
  4. c:\windows\screentk.sys - not-a-virus:NetTool.Win64.NetFilter.a ( DrWEB: Tool.NetFilter.313 )
  5. c:\windows\storegidfilter.sys - not-a-virus:AdWare.Win32.Agent.gvwa
  6. c:\windows\system32\hfnapi.dll - Trojan-Downloader.Win32.Agent.heqj ( DrWEB: Trojan.DownLoader11.19028, BitDefender: Gen:Variant.Adware.Netfilter.2, AVAST4: Win32:Malware-gen )
  7. c:\windows\system32\hfpapi.dll - not-a-virus:HEUR:RiskTool.Win32.NetFilter.heur ( DrWEB: Tool.NetFilter.2, BitDefender: Gen:Variant.Adware.Netfilter.2, AVAST4: Win32:Adware-gen [Adw] )
  8. c:\windows\system32\netupdsrv.exe - not-a-virus:HEUR:RiskTool.Win32.NetFilter.heur ( DrWEB: BackDoor.Siggen.57737, BitDefender: Gen:Variant.Adware.Netfilter.2 )
  9. c:\windows\syswow64\hfnapi.dll - Trojan-Downloader.Win32.Agent.heqj ( DrWEB: Trojan.DownLoader11.19028, BitDefender: Gen:Variant.Adware.Netfilter.2, AVAST4: Win32:Malware-gen )
  10. c:\windows\syswow64\hfpapi.dll - not-a-virus:HEUR:RiskTool.Win32.NetFilter.heur ( DrWEB: Tool.NetFilter.2, BitDefender: Gen:Variant.Adware.Netfilter.2, AVAST4: Win32:Adware-gen [Adw] )