Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-1-6.exe');
TerminateProcessByName('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe');
TerminateProcessByName('c:\program files (x86)\gmsd_ru_005010029\gmsd_ru_005010029.exe');
TerminateProcessByName('c:\program files (x86)\it viewer\privoxy.exe');
TerminateProcessByName('c:\users\-\appdata\local\smartweb\smartwebapp.exe');
TerminateProcessByName('c:\users\-\appdata\local\smartweb\smartwebhelper.exe');
TerminateProcessByName('c:\users\-\appdata\local\gmsd_ru_005010029\upgmsd_ru_005010029.exe');
TerminateProcessByName('c:\program files (x86)\ytdownloader\ytdownloader.exe');
TerminateProcessByName('c:\users\-\appdata\roaming\27c9f97a-1436691174-e111-940d-dc0ea1e1221b\knsa4757.tmp');
StopService('guwymomi');
StopService('PrivoxyService');
StopService('SPDRIVER_1.42.1.2118');
QuarantineFileF('c:\program files (x86)\ciplus', '*', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\crossbrowse', '*', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\it viewer', '*', true, '', 0 , 0);
QuarantineFileF('c:\users\-\appdata\local\smartwe', '*', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\ytdownloader', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\globalUpdate', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files\netfilter', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\ShopperPro', '*', true, '', 0 , 0);
QuarantineFileF('C:\IQIYI Video', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\CouponsPlus', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\ShopperPro', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\iWebar', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\AnyProtectEx', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\-\AppData\Local\Host installer', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\WordSurfer', '*', true, '', 0 , 0);
QuarantineFile('c:\program files (x86)\ciplus-4.5vv12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-1-6.exe', '');
QuarantineFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe', '');
QuarantineFile('c:\program files (x86)\gmsd_ru_005010029\gmsd_ru_005010029.exe', '');
QuarantineFile('c:\program files (x86)\it viewer\privoxy.exe', '');
QuarantineFile('c:\users\-\appdata\local\smartweb\smartwebapp.exe', '');
QuarantineFile('c:\users\-\appdata\local\smartweb\smartwebhelper.exe', '');
QuarantineFile('c:\users\-\appdata\local\gmsd_ru_005010029\upgmsd_ru_005010029.exe', '');
QuarantineFile('c:\program files (x86)\ytdownloader\ytdownloader.exe', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll', '');
QuarantineFile('C:\Users\-\AppData\Local\SmartWeb\swhk.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libglesv2.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libegl.dll', '');
QuarantineFile('C:\Program Files (x86)\IT Viewer\mgwz.dll', '');
QuarantineFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe', '');
QuarantineFile('C:\windows\mlwps.exe', '');
QuarantineFile('C:\Program Files\netfilter\PFHttpContentFilter.exe', '');
QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2118\jsdrv.sys', '');
QuarantineFile('C:\windows\system32\drivers\netfilter2.sys', '');
QuarantineFile('C:\windows\system32\drivers\wsfd_vt_1_10_0_20.sys', '');
QuarantineFile('C:\IQIYI Video\Common\QyKernel.exe', '');
QuarantineFile('C:\Program Files (x86)\Internet Explorer\iexplore.bat', '');
QuarantineFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2118\jsdrv.exe', '');
QuarantineFile('C:\Program Files (x86)\gmsd_ru_005010028\gmsd_ru_005010028.exe', '');
QuarantineFile('C:\ProgramData\{bad8c352-0e85-6c8f-bad8-8c3520e80d48}\Download.exe', '');
QuarantineFile('C:\Users\-\AppData\Local\gmsd_ru_005010028\upgmsd_ru_005010029.exe', '');
QuarantineFile('C:\Users\-\AppData\Roaming\Browsers\exe.erolpxei.bat', '');
QuarantineFile('C:\windows\winstart.bat', '');
QuarantineFile('C:\Program Files (x86)\CouponsPlus\Q3gbYLgNEpr3Bk.dll', '');
QuarantineFile('C:\ProgramData\ShopperPro\ShopperPro.dll', '');
QuarantineFile('C:\IQIYI Video\Common\Accelerator\IEHelper.dll', '');
QuarantineFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-1-6.exe', '');
QuarantineFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-1-7.exe', '');
QuarantineFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-11.exe', '');
QuarantineFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-4.exe', '');
QuarantineFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-5.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-1-7.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-10.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-4.exe', '');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-5.exe', '');
QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '');
QuarantineFile('c:\programdata\{3adbeaa5-3120-455f-3adb-beaa5312aa94}\download.exe', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '');
QuarantineFile('C:\Users\-\AppData\Roaming\DeBMPZ57MncBmdn9yOktLW.exe', '');
QuarantineFile('C:\Users\-\AppData\Roaming\KBYisFa7oQIJruff8ZW2.exe', '');
QuarantineFile('C:\Program Files (x86)\IT Viewer\astask.exe', '');
QuarantineFile('C:\PROGRA~1\COMMON~1\System\SysMenu.dll', '');
QuarantineFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe', '');
QuarantineFile('C:\Program Files (x86)\ShopperPro\updater.exe', '');
QuarantineFile('C:\Users\-\AppData\Local\Host installer\3057723539_installcube.exe', '');
QuarantineFile('C:\ProgramData\ShopperPro\spbihe.js', '');
QuarantineFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe', '');
QuarantineFile('C:\Program Files (x86)\YTDownloader\updater.exe', '');
QuarantineFile('C:\Users\-\appdata\local\smartweb\__u.exe', '');
QuarantineFile('c:\users\-\appdata\roaming\27c9f97a-1436691174-e111-940d-dc0ea1e1221b\knsa4757.tmp', '');
DeleteFile('c:\program files (x86)\ciplus-4.5vv12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-1-6.exe', '32');
DeleteFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe', '32');
DeleteFile('c:\program files (x86)\gmsd_ru_005010029\gmsd_ru_005010029.exe', '32');
DeleteFile('c:\program files (x86)\it viewer\privoxy.exe', '32');
DeleteFile('c:\users\-\appdata\local\smartweb\smartwebapp.exe', '32');
DeleteFile('c:\users\-\appdata\local\smartweb\smartwebhelper.exe', '32');
DeleteFile('c:\users\-\appdata\local\gmsd_ru_005010029\upgmsd_ru_005010029.exe', '32');
DeleteFile('c:\program files (x86)\ytdownloader\ytdownloader.exe', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll', '32');
DeleteFile('C:\Users\-\AppData\Local\SmartWeb\swhk.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libglesv2.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libegl.dll', '32');
DeleteFile('C:\Program Files (x86)\IT Viewer\mgwz.dll', '32');
DeleteFile('C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe', '32');
DeleteFile('C:\windows\mlwps.exe', '32');
DeleteFile('C:\Program Files\netfilter\PFHttpContentFilter.exe', '32');
DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2118\jsdrv.sys', '32');
DeleteFile('C:\windows\system32\drivers\netfilter2.sys', '32');
DeleteFile('C:\windows\system32\drivers\wsfd_vt_1_10_0_20.sys', '32');
DeleteFile('C:\IQIYI Video\Common\QyKernel.exe', '32');
DeleteFile('C:\Program Files (x86)\Internet Explorer\iexplore.bat', '32');
DeleteFile('C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2118\jsdrv.exe', '32');
DeleteFile('C:\Program Files (x86)\gmsd_ru_005010028\gmsd_ru_005010028.exe', '32');
DeleteFile('C:\ProgramData\{bad8c352-0e85-6c8f-bad8-8c3520e80d48}\Download.exe', '32');
DeleteFile('C:\Users\-\AppData\Local\gmsd_ru_005010028\upgmsd_ru_005010029.exe', '32');
DeleteFile('C:\Users\-\AppData\Roaming\Browsers\exe.erolpxei.bat', '32');
DeleteFile('C:\windows\winstart.bat', '32');
DeleteFile('C:\Program Files (x86)\CouponsPlus\Q3gbYLgNEpr3Bk.dll', '32');
DeleteFile('C:\ProgramData\ShopperPro\ShopperPro.dll', '32');
DeleteFile('C:\IQIYI Video\Common\Accelerator\IEHelper.dll', '32');
DeleteFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-1-6.exe', '32');
DeleteFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-1-7.exe', '32');
DeleteFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-11.exe', '32');
DeleteFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-4.exe', '32');
DeleteFile('C:\Program Files (x86)\iWebar\1d68102c-0a19-4550-8ef5-a35ace4cd988-5.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-1-7.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-10.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-4.exe', '32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV12.07\a6a1928c-301c-4ec4-b804-5c5993199f7d-5.exe', '32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32');
DeleteFile('c:\programdata\{3adbeaa5-3120-455f-3adb-beaa5312aa94}\download.exe', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '32');
DeleteFile('C:\Users\-\AppData\Roaming\DeBMPZ57MncBmdn9yOktLW.exe', '32');
DeleteFile('C:\Users\-\AppData\Roaming\KBYisFa7oQIJruff8ZW2.exe', '32');
DeleteFile('C:\Program Files (x86)\IT Viewer\astask.exe', '32');
DeleteFile('C:\PROGRA~1\COMMON~1\System\SysMenu.dll', '32');
DeleteFile('C:\Program Files (x86)\ShopperPro\ShopperPro.exe', '32');
DeleteFile('C:\Program Files (x86)\ShopperPro\updater.exe', '32');
DeleteFile('C:\Users\-\AppData\Local\Host installer\3057723539_installcube.exe', '32');
DeleteFile('C:\ProgramData\ShopperPro\spbihe.js', '32');
DeleteFile('C:\Program Files (x86)\WordSurfer_1.10.0.19\Update\WordSurferAutoUpdateClient.exe', '32');
DeleteFile('C:\Program Files (x86)\YTDownloader\updater.exe', '32');
DeleteFile('C:\Users\-\appdata\local\smartweb\__u.exe', '32');
DeleteFile('c:\users\-\appdata\roaming\27c9f97a-1436691174-e111-940d-dc0ea1e1221b\knsa4757.tmp', '32');
DeleteService('guwymomi');
DeleteService('PrivoxyService');
DeleteService('globalUpdate');
DeleteService('globalUpdatem');
DeleteService('Live Malware Protection');
DeleteService('PFHttpContentFilter.exe');
DeleteService('SPDRIVER_1.42.1.2118');
DeleteService('netfilter2');
DeleteService('wsfd_vt_1_10_0_20');
DeleteFileMask('c:\program files (x86)\ciplus', '*', true);
DeleteFileMask('c:\program files (x86)\crossbrowse', '*', true);
DeleteFileMask('c:\program files (x86)\it viewer', '*', true);
DeleteFileMask('c:\users\-\appdata\local\smartwe', '*', true);
DeleteFileMask('c:\program files (x86)\ytdownloader', '*', true);
DeleteFileMask('C:\Program Files (x86)\globalUpdate', '*', true);
DeleteFileMask('C:\Program Files\netfilter', '*', true);
DeleteFileMask('C:\Program Files (x86)\ShopperPro', '*', true);
DeleteFileMask('C:\IQIYI Video', '*', true);
DeleteFileMask('C:\Program Files (x86)\CouponsPlus', '*', true);
DeleteFileMask('C:\ProgramData\ShopperPro', '*', true);
DeleteFileMask('C:\Program Files (x86)\iWebar', '*', true);
DeleteFileMask('C:\Program Files (x86)\AnyProtectEx', '*', true);
DeleteFileMask('C:\Users\-\AppData\Local\Host installer', '*', true);
DeleteFileMask('C:\Program Files (x86)\WordSurfer', '*', true);
DeleteFileMask('c:\users\-\appdata\roaming\27c9f97a-1436691174-e111-940d-dc0ea1e1221b', '*', true);
DeleteDirectory('c:\program files (x86)\ciplus');
DeleteDirectory('c:\program files (x86)\crossbrowse');
DeleteDirectory('c:\program files (x86)\it viewer');
DeleteDirectory('c:\users\-\appdata\local\smartwe');
DeleteDirectory('c:\program files (x86)\ytdownloader');
DeleteDirectory('C:\Program Files (x86)\globalUpdate');
DeleteDirectory('C:\Program Files\netfilter');
DeleteDirectory('C:\Program Files (x86)\ShopperPro');
DeleteDirectory('C:\IQIYI Video');
DeleteDirectory('C:\Program Files (x86)\CouponsPlus');
DeleteDirectory('C:\ProgramData\ShopperPro');
DeleteDirectory('C:\Program Files (x86)\iWebar');
DeleteDirectory('C:\Program Files (x86)\AnyProtectEx');
DeleteDirectory('C:\Users\-\AppData\Local\Host installer');
DeleteDirectory('C:\Program Files (x86)\WordSurfer');
DeleteDirectory('c:\users\-\appdata\roaming\27c9f97a-1436691174-e111-940d-dc0ea1e1221b');
DelBHO('{1E009B51-AC4A-426A-88FE-9BF8BE32AF90}');
DelBHO('{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}');
DelBHO('{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}');
DelBHO('{0633EE93-D776-472f-A0FF-E1416B8B2E3D}');
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-1-6.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-1-7.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-11.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-4.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-5.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "1d68102c-0a19-4550-8ef5-a35ace4cd988-5_user.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-1-6.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-1-7.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-10_user.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-4.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-5.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-5_user.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "CleanYourCache.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Crossbrowse.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "DeBMPZ57MncBmdn9yOktLW.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KBYisFa7oQIJruff8ZW2.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-1-6" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-1-7" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-4" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "a6a1928c-301c-4ec4-b804-5c5993199f7d-5" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "CleanYourCache" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Crossbrowse" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineCore" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "globalUpdateUpdateTaskMachineUA" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "IT Viewer Viewer" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SMupdate2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SMupdate3" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "ShopperPro" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "ShopperProJSUpd" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SMupdate1" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Soft installer" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SPBIW_UpdateTask_Time_3734313635303038372d3437415a556c2a3223346c41" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SPDriver" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "WordSurfer Auto Updater 1.10.0.19 Core" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "WordSurfer Auto Updater 1.10.0.19 Pending Update" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "YTDownloader" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "YTDownloaderUpd" /F', 0, 15000, true);
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HCDNClient', 'command');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'GoogleChromeAutoLaunch_4300C68794D14109C3832816352E47FA');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\GoogleChromeAutoLaunch_4300C68794D14109C3832816352E47FA', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SPDriver', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YTDownloader', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010028', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'gmsd_ru_005010029');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SmartWeb');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SmartWeb', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'upgmsd_ru_005010029.exe');
QuarantineFileF('C:\Windows\system32\GroupPolicy', '*', true,'', 0, 0, '', '', '');
DeleteFile('C:\Windows\system32\GroupPolicy\GPT.ini', '32');
DeleteFileMask('C:\Windows\system32\GroupPolicy\Machine', '*', true);
if IsWOW64 then begin
QuarantineFileF('C:\Windows\SysWOW64\GroupPolicy', '*', true,'', 0, 0, '', '', '');
DeleteFile('C:\Windows\system32\GroupPolicy\GPT.ini', '64');
DeleteFileMask('C:\Windows\SysWOW64\GroupPolicy\Machine', '*', true);
end;
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
ExecuteRepair(23);
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.