Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
QuarantineFileF('c:\users\unl00ser\appdata\roaming\11bitstudios\ctfhost', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFile('C:\Users\unl00ser\AppData\Local\Temp\pps-qq-19.exe', '');
QuarantineFile('C:\Users\unl00ser\AppData\Roaming\11bitstudios\Ctfhost\ctfhost.exe', '');
QuarantineFile('C:\Users\unl00ser\AppData\Local\Temp\start.exe', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.1.16923.222\QQPCTRAY.EXE', '');
QuarantineFile('c:\pcfiXtrayanrpa.lnk', '');
QuarantineFile('c:\pcfiXtraytlryv.lnk', '');
QuarantineFile('c:\pcfiXtraywkzkz.lnk', '');
QuarantineFile('c:\pcfiXtraykvhwu.lnk', '');
QuarantineFile('c:\pcfiXtrayrvtjc.lnk', '');
QuarantineFile('c:\pcfiXtraypdcde.lnk', '');
QuarantineFile('c:\pcfiXtraykxtqf.lnk', '');
QuarantineFile('c:\pcfiXtrayjifzs.lnk', '');
QuarantineFile('c:\pcfiXtraygdymo.lnk', '');
QuarantineFile('c:\pcfiXtrayxybzz.lnk', '');
QuarantineFile('c:\pcfiXtrayobapt.lnk', '');
QuarantineFile('c:\pcfiXtrayaqrqa.lnk', '');
QuarantineFile('c:\pcfiXtraykxfpt.lnk', '');
QuarantineFile('c:\pcfiXtrayvsgzj.lnk', '');
QuarantineFile('c:\pcfiXtraytzfxg.lnk', '');
QuarantineFile('c:\pcfiXtrayjpqfn.lnk', '');
QuarantineFile('c:\pcfiXtraylbuxi.lnk', '');
QuarantineFile('c:\pcfiXtrayldgda.lnk', '');
QuarantineFile('c:\pcfiXtraybwsss.lnk', '');
QuarantineFile('c:\pcfiXtrayxmalr.lnk', '');
QuarantineFile('c:\pcfiXtrayfvxml.lnk', '');
QuarantineFile('c:\pcfiXtraykguco.lnk', '');
QuarantineFile('c:\pcfiXtrayjjqab.lnk', '');
QuarantineFile('c:\pcfiXtraykcuio.lnk', '');
QuarantineFile('c:\pcfiXtraynszzu.lnk', '');
QuarantineFile('c:\pcfiXtrayqcazb.lnk', '');
QuarantineFile('c:\pcfiXtrayyinax.lnk', '');
QuarantineFile('c:\pcfiXtrayabfcx.lnk', '');
QuarantineFile('c:\pcfiXtrayrgphq.lnk', '');
QuarantineFile('c:\pcfiXtrayzunpg.lnk', '');
QuarantineFile('c:\pcfiXtrayplljq.lnk', '');
QuarantineFile('c:\pcfiXtraylgjqd.lnk', '');
QuarantineFile('c:\pcfiXtraysdrdd.lnk', '');
QuarantineFile('c:\pcfiXtraygkbnx.lnk', '');
QuarantineFile('c:\pcfiXtraydcirf.lnk', '');
QuarantineFile('c:\pcfiXtrayqeoyq.lnk', '');
QuarantineFile('c:\pcfiXtrayojakk.lnk', '');
QuarantineFile('c:\pcfiXtrayvhjnk.lnk', '');
QuarantineFile('c:\pcfiXtrayliwqz.lnk', '');
QuarantineFile('c:\pcfiXtrayhjaog.lnk', '');
QuarantineFile('c:\pcfiXtraydxjen.lnk', '');
QuarantineFile('c:\pcfiXtrayouzcv.lnk', '');
QuarantineFile('c:\pcfiXtrayvckbs.lnk', '');
QuarantineFile('c:\pcfiXtrayoyocq.lnk', '');
QuarantineFile('c:\pcfiXtraycjimp.lnk', '');
QuarantineFile('c:\pcfiXtrayclkvh.lnk', '');
QuarantineFile('c:\pcfiXtraybmefk.lnk', '');
QuarantineFile('c:\pcfiXtraymhwza.lnk', '');
QuarantineFile('c:\pcfiXtrayrpcwl.lnk', '');
QuarantineFile('c:\pcfiXtrayogkhy.lnk', '');
QuarantineFile('c:\pcfiXtraymtxfj.lnk', '');
QuarantineFile('c:\pcfiXtrayjteiq.lnk', '');
QuarantineFile('c:\pcfiXtrayadswb.lnk', '');
QuarantineFile('c:\pcfiXtraytlikj.lnk', '');
QuarantineFile('c:\pcfiXtraylbiyu.lnk', '');
QuarantineFile('c:\pcfiXtraygzmus.lnk', '');
QuarantineFile('c:\pcfiXtrayfkxsl.lnk', '');
QuarantineFile('c:\pcfiXtrayemxwf.lnk', '');
QuarantineFile('c:\pcfiXtraynflcd.lnk', '');
QuarantineFile('c:\pcfiXtrayuowie.lnk', '');
QuarantineFile('c:\pcfiXtraynblbe.lnk', '');
QuarantineFile('c:\pcfiXtrayvnvjn.lnk', '');
QuarantineFile('c:\pcfiXtrayzddpm.lnk', '');
QuarantineFile('c:\pcfiXtrayqwprk.lnk', '');
QuarantineFile('c:\pcfiXtrayhjdij.lnk', '');
QuarantineFile('c:\pcfiXtrayvllvb.lnk', '');
QuarantineFile('c:\pcfiXtraygfzqv.lnk', '');
QuarantineFile('c:\pcfiXtraylruqx.lnk', '');
QuarantineFile('c:\pcfiXtraywnyzf.lnk', '');
QuarantineFile('c:\pcfiXtrayegxzu.lnk', '');
QuarantineFile('c:\pcfiXtraybyqyy.lnk', '');
QuarantineFile('c:\pcfiXtraywempw.lnk', '');
QuarantineFile('c:\pcfiXtraywlyvy.lnk', '');
QuarantineFile('c:\pcfiXtrayxgkml.lnk', '');
QuarantineFile('c:\pcfiXtraynsnay.lnk', '');
QuarantineFile('c:\pcfiXtrayhwcuj.lnk', '');
QuarantineFile('c:\pcfiXtraygdxhd.lnk', '');
QuarantineFile('c:\pcfiXtrayeekfq.lnk', '');
DeleteFile('C:\Users\unl00ser\AppData\Local\Temp\pps-qq-19.exe', '32');
DeleteFile('C:\Users\unl00ser\AppData\Roaming\11bitstudios\Ctfhost\ctfhost.exe', '32');
DeleteFile('C:\Users\unl00ser\AppData\Local\Temp\start.exe', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\11.1.16923.222\QQPCTRAY.EXE');
DeleteFile('c:\pcfiXtrayanrpa.lnk');
DeleteFile('c:\pcfiXtraytlryv.lnk');
DeleteFile('c:\pcfiXtraywkzkz.lnk');
DeleteFile('c:\pcfiXtraykvhwu.lnk');
DeleteFile('c:\pcfiXtrayrvtjc.lnk');
DeleteFile('c:\pcfiXtraypdcde.lnk');
DeleteFile('c:\pcfiXtraykxtqf.lnk');
DeleteFile('c:\pcfiXtrayjifzs.lnk');
DeleteFile('c:\pcfiXtraygdymo.lnk');
DeleteFile('c:\pcfiXtrayxybzz.lnk');
DeleteFile('c:\pcfiXtrayobapt.lnk');
DeleteFile('c:\pcfiXtrayaqrqa.lnk');
DeleteFile('c:\pcfiXtraykxfpt.lnk');
DeleteFile('c:\pcfiXtrayvsgzj.lnk');
DeleteFile('c:\pcfiXtraytzfxg.lnk');
DeleteFile('c:\pcfiXtrayjpqfn.lnk');
DeleteFile('c:\pcfiXtraylbuxi.lnk');
DeleteFile('c:\pcfiXtrayldgda.lnk');
DeleteFile('c:\pcfiXtraybwsss.lnk');
DeleteFile('c:\pcfiXtrayxmalr.lnk');
DeleteFile('c:\pcfiXtrayfvxml.lnk');
DeleteFile('c:\pcfiXtraykguco.lnk');
DeleteFile('c:\pcfiXtrayjjqab.lnk');
DeleteFile('c:\pcfiXtraykcuio.lnk');
DeleteFile('c:\pcfiXtraynszzu.lnk');
DeleteFile('c:\pcfiXtrayqcazb.lnk');
DeleteFile('c:\pcfiXtrayyinax.lnk');
DeleteFile('c:\pcfiXtrayabfcx.lnk');
DeleteFile('c:\pcfiXtrayrgphq.lnk');
DeleteFile('c:\pcfiXtrayzunpg.lnk');
DeleteFile('c:\pcfiXtrayplljq.lnk');
DeleteFile('c:\pcfiXtraylgjqd.lnk');
DeleteFile('c:\pcfiXtraysdrdd.lnk');
DeleteFile('c:\pcfiXtraygkbnx.lnk');
DeleteFile('c:\pcfiXtraydcirf.lnk');
DeleteFile('c:\pcfiXtrayqeoyq.lnk');
DeleteFile('c:\pcfiXtrayojakk.lnk');
DeleteFile('c:\pcfiXtrayvhjnk.lnk');
DeleteFile('c:\pcfiXtrayliwqz.lnk');
DeleteFile('c:\pcfiXtrayhjaog.lnk');
DeleteFile('c:\pcfiXtraydxjen.lnk');
DeleteFile('c:\pcfiXtrayouzcv.lnk');
DeleteFile('c:\pcfiXtrayvckbs.lnk');
DeleteFile('c:\pcfiXtrayoyocq.lnk');
DeleteFile('c:\pcfiXtraycjimp.lnk');
DeleteFile('c:\pcfiXtrayclkvh.lnk');
DeleteFile('c:\pcfiXtraybmefk.lnk');
DeleteFile('c:\pcfiXtraymhwza.lnk');
DeleteFile('c:\pcfiXtrayrpcwl.lnk');
DeleteFile('c:\pcfiXtrayogkhy.lnk');
DeleteFile('c:\pcfiXtraymtxfj.lnk');
DeleteFile('c:\pcfiXtrayjteiq.lnk');
DeleteFile('c:\pcfiXtrayadswb.lnk');
DeleteFile('c:\pcfiXtraytlikj.lnk');
DeleteFile('c:\pcfiXtraylbiyu.lnk');
DeleteFile('c:\pcfiXtraygzmus.lnk');
DeleteFile('c:\pcfiXtrayfkxsl.lnk');
DeleteFile('c:\pcfiXtrayemxwf.lnk');
DeleteFile('c:\pcfiXtraynflcd.lnk');
DeleteFile('c:\pcfiXtrayuowie.lnk');
DeleteFile('c:\pcfiXtraynblbe.lnk');
DeleteFile('c:\pcfiXtrayvnvjn.lnk');
DeleteFile('c:\pcfiXtrayzddpm.lnk');
DeleteFile('c:\pcfiXtrayqwprk.lnk');
DeleteFile('c:\pcfiXtrayhjdij.lnk');
DeleteFile('c:\pcfiXtrayvllvb.lnk');
DeleteFile('c:\pcfiXtraygfzqv.lnk');
DeleteFile('c:\pcfiXtraylruqx.lnk');
DeleteFile('c:\pcfiXtraywnyzf.lnk');
DeleteFile('c:\pcfiXtrayegxzu.lnk');
DeleteFile('c:\pcfiXtraybyqyy.lnk');
DeleteFile('c:\pcfiXtraywempw.lnk');
DeleteFile('c:\pcfiXtraywlyvy.lnk');
DeleteFile('c:\pcfiXtrayxgkml.lnk');
DeleteFile('c:\pcfiXtraynsnay.lnk');
DeleteFile('c:\pcfiXtrayhwcuj.lnk');
DeleteFile('c:\pcfiXtraygdxhd.lnk');
DeleteFile('c:\pcfiXtrayeekfq.lnk');
ExecuteFile('schtasks.exe', '/delete /TN "CTF Host" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "WdfHG" /F', 0, 15000, true);
DeleteFileMask('c:\users\unl00ser\appdata\roaming\11bitstudios\ctfhost', '*', true);
DeleteDirectory('c:\users\unl00ser\appdata\roaming\11bitstudios\ctfhost');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'pps-qq-19');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', ' QQPCTray');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYDSTLS');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYEXIKT');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYTMHWW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYEOEOH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYUAXTL');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYLCPSX');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYBVYXJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYMFVPL');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYBCRTH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYELGPZ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYZMLHZ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYXVHGV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYMOFKK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYGPCYV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSTWUI');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYJPLWI');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYCDDMK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSENAN');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYCQHQW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYFOUMN');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYOIRKW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYHHXFL');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYOCGSB');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYNWJLB');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYZLPXT');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSGIWJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYXZCCV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYZLZZF');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYJVGYJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYMYQLT');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSAHVV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYWLINA');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYRCHVG');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYZOHXY');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYKGKUK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYXKTIJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYMILWM');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYRXBYH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSPBYJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYHXSEJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYKVWWW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYIFEQG');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYQMNAM');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYUNIVM');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYRRMAG');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYDUZQY');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYYPEKY');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYIRLWT');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYTPJVX');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYNEGCT');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYHOPGY');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSGSVJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYWSTIH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYWSQHV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYKKEZJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYXXXEW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYNYDQM');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYPIVAJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYDTFUM');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYSXGDB');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYCISAK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYIGQBL');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYZOAAK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYKUKOV');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYRLGWU');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYWYEQO');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYNHMPI');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYNGLNA');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYMRDWA');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYTVQWK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYKLQRJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYCUSTJ');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYAEHAH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYLJXRY');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYPSIKK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYAWUUH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PCFIXTRAYBEAZJ');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.