Код:
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\user\AppData\Roaming\istartsurf\UninstallManager.exe','');
QuarantineFile('C:\Users\user\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE','');
QuarantineFile('C:\Users\user\AppData\Roaming\Gtrm6c5.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-4.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.exe','');
QuarantineFile('C:\Program Files (x86)\XTab\SupTab.dll','');
QuarantineFile('C:\Users\user\AppData\Roaming\Browsers\exe.resworb.bat','');
QuarantineFile('C:\Users\user\AppData\Roaming\Browsers\exe.erolpxei.bat','');
QuarantineFile('C:\Users\user\AppData\Local\SmartWeb\SmartWebHelper.exe','');
QuarantineFile('C:\Users\user\AppData\Local\Kometa\kometaup.exe','');
QuarantineFile('C:\Users\user\AppData\Local\6981491E-1432852123-3DA1-DA6B-10C37B1946B8\bnsk55F1.exe','');
SetServiceStart('TSSysKit', 4);
DeleteService('TSSysKit');
DeleteService('TSDefenseBt');
SetServiceStart('TSCPM', 4);
DeleteService('TSCPM');
SetServiceStart('TAOKernelDriver', 4);
DeleteService('TAOKernelDriver');
QuarantineFile('QQSysMonX64.sys','');
SetServiceStart('QQSysMonX64', 4);
DeleteService('QQSysMonX64');
SetServiceStart('QMUdisk', 4);
DeleteService('QMUdisk');
SetServiceStart('qelejify', 4);
DeleteService('qelejify');
SetServiceStart('pegohuho', 4);
DeleteService('pegohuho');
SetServiceStart('WindowsMangerProtect', 4);
DeleteService('WindowsMangerProtect');
SetServiceStart('dyvehiqu', 4);
SetServiceStart('lozycegu', 4);
DeleteService('lozycegu');
QuarantineFile('C:\Program Files (x86)\XTab\ProtectService.exe','');
DeleteService('IHProtect Service');
QuarantineFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe','');
DeleteService('globalUpdate');
DeleteService('dyvehiqu');
QuarantineFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys','');
TerminateProcessByName('c:\program files (x86)\gmsd_ru_258\gmsd_ru_258.exe');
QuarantineFile('c:\program files (x86)\gmsd_ru_258\gmsd_ru_258.exe','');
TerminateProcessByName('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe');
QuarantineFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','');
TerminateProcessByName('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\hnskf159.tmp');
QuarantineFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\hnskf159.tmp','');
TerminateProcessByName('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\jnshd0ee.tmp');
QuarantineFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\jnshd0ee.tmp','');
TerminateProcessByName('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\nsg9b61.tmpfs');
QuarantineFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\nsg9b61.tmpfs','');
DeleteFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\nsg9b61.tmpfs','32');
DeleteFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\jnshd0ee.tmp','32');
DeleteFile('c:\users\user\appdata\roaming\6981491e-1432841271-3da1-da6b-10c37b1946b8\hnskf159.tmp','32');
DeleteFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','32');
DeleteFile('c:\program files (x86)\gmsd_ru_258\gmsd_ru_258.exe','32');
DeleteFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys','32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QMUdisk64.sys','32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\QQSysMonX64.sys','32');
DeleteFile('C:\Windows\System32\Drivers\TAOKernel64.sys','32');
DeleteFile('C:\Windows\system32\Drivers\TFsFltX64.sys','32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\tscpm64.sys','32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\TSSysKit64.sys','32');
DeleteFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe','32');
DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe','32');
DeleteFile('QQSysMonX64.sys','32');
DeleteFile('C:\Windows\system32\Drivers\TAOKernel64.sys','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_ru_258');
DeleteFile('C:\Users\user\AppData\Local\6981491E-1432852123-3DA1-DA6B-10C37B1946B8\bnsk55F1.exe','32');
DeleteFile('C:\Users\user\AppData\Local\Kometa\kometaup.exe','32');
DeleteFile('C:\Users\user\AppData\Local\SmartWeb\SmartWebHelper.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SmartWeb');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','kometaup');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','WinCheck');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','upgmsd_ru_258.exe');
DeleteFile('C:\Users\user\AppData\Roaming\Browsers\exe.erolpxei.bat','32');
DeleteFile('C:\Users\user\AppData\Roaming\Browsers\exe.resworb.bat','32');
DeleteFile('C:\Program Files (x86)\XTab\SupTab.dll','32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.job','64');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.job','64');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10_user.job','64');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.job','64');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-4.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-4.job','64');
DeleteFile('C:\Program Files (x86)\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.job','64');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5_user.job','64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job','64');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job','64');
DeleteFile('C:\Windows\Tasks\Gtrm6c5.job','64');
DeleteFile('C:\Users\user\AppData\Roaming\Gtrm6c5.exe','32');
DeleteFile('C:\Users\user\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE','32');
DeleteFile('C:\Windows\Tasks\UpdaterEX.job','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10_user','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-4','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5','64');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5_user','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineCore','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineUA','64');
DeleteFile('C:\Windows\system32\Tasks\Gtrm6c5','64');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','64');
DeleteFile('C:\Windows\system32\Tasks\Soft installer','64');
DeleteFile('C:\Users\user\AppData\Local\Host installer\4265501545_installcube.exe','32');
DeleteFile('C:\Windows\system32\Tasks\UpdaterEX','64');
DeleteFile('C:\Users\user\AppData\Roaming\istartsurf\UninstallManager.exe','32');
DeleteFile('C:\Windows\system32\Tasks\{E067D631-EB6A-4FEA-8EDE-94B55E604F79}','64');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.
Компьютер перезагрузится.