Код:
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\Julia\AppData\Local\Ovics\tmp197B.exe','');
QuarantineFile('C:\Program Files\contentprotector\nss\certutil.exe','');
QuarantineFile('C:\Program Files\contentprotector\import_root_cert.exe','');
QuarantineFile('C:\Program Files\contentprotector\contentprotectorupdate.exe','');
QuarantineFile('C:\Program Files\contentprotector\contentprotector.exe','');
QuarantineFile('C:\Program Files\contentprotector\contentprotectordrv.sys','');
QuarantineFile('C:\Program Files\contentprotector\contentprotectorconrol.exe','');
QuarantineFile('C:\Program Files\contentprotector\conprotsetup.exe','');
QuarantineFile('C:\Program Files\contentprotector\condefclean.exe','');
QuarantineFile('c:\users\julia\appdata\local\microsoft\protect\protecthost.dll','');
QuarantineFile('C:\Users\Администратор\AppData\Roaming\52f8af\f9be1b.6e5b034','');
QuarantineFile('C:\Users\Julia\AppData\Roaming\52f8af\f9be1b.6e5b034','');
QuarantineFile('C:\Users\Julia\AppData\Roaming\Microsoft\Crypto\sysras.exe','');
QuarantineFile('C:\Users\Julia\AppData\Local\Ovics\vnljakml.dll','');
QuarantineFile('C:\Users\Julia\AppData\Local\IQQsoft\qccdytlr.dll','');
TerminateProcessByName('c:\users\julia\appdata\local\ovics\tmp197b.exe');
QuarantineFile('c:\users\julia\appdata\local\ovics\tmp197b.exe','');
QuarantineFile('C:\Program Files\BDAntiCryptoLocker\BDAntiCryptoLocker.exe','');
DeleteFile('c:\users\julia\appdata\local\ovics\tmp197b.exe','32');
DeleteFile('C:\Users\Julia\AppData\Local\IQQsoft\qccdytlr.dll','32');
DeleteFile('C:\Users\Julia\AppData\Local\Ovics\vnljakml.dll','32');
DeleteFile('C:\Users\Julia\AppData\Roaming\Microsoft\Crypto\sysras.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','2e7a6119');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YjbPack');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','IQQsoft');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Ovics');
DeleteFile('C:\Users\Julia\AppData\Roaming\52f8af\f9be1b.6e5b034','32');
DeleteFile('C:\Users\Администратор\AppData\Roaming\52f8af\f9be1b.6e5b034','32');
DeleteFile('C:\Program Files\contentprotector\condefclean.exe','32');
DeleteFile('c:\users\julia\appdata\local\microsoft\protect\protecthost.dll','32');
DeleteFile('C:\Program Files\contentprotector\conprotsetup.exe','32');
DeleteFile('C:\Program Files\contentprotector\contentprotectorconrol.exe','32');
DeleteFile('C:\Program Files\contentprotector\contentprotectordrv.sys','32');
DeleteFile('C:\Program Files\contentprotector\contentprotector.exe','32');
DeleteFile('C:\Program Files\contentprotector\contentprotectorupdate.exe','32');
DeleteFile('C:\Program Files\contentprotector\import_root_cert.exe','32');
DeleteFile('C:\Program Files\contentprotector\libeay32.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\certutil.exe','32');
DeleteFile('C:\Program Files\contentprotector\nss\mozcrt19.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\nspr4.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\nss3.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\plc4.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\plds4.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\smime3.dll','32');
DeleteFile('C:\Program Files\contentprotector\nss\softokn3.dll','32');
DeleteFile('C:\Program Files\contentprotector\ssleay32.dll','32');
DeleteFile('C:\Users\Julia\AppData\Local\Ovics\tmp197B.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.
Будет выполнена перезагрузка компьютера.