Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Users\Shkotov\AppData\Local\zxcoal.dll', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\MoonWiki\ml.py', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\ARMATE~1\ml.py', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Adobemnr\AdobeL.exe', '');
QuarantineFile('C:\Program Files\baidu\BindEx.exe', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Mail.Ru\Agent\magent.exe', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdcont.exe', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdrpo2t.exe', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdrpo2t.exe.sha1', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvidload.exe', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvidload.exe.sha1', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\ARMATE~1\app.py', '');
QuarantineFile('C:\Users\Shkotov\AppData\Roaming\MoonWiki\app.py', '');
DeleteFile('C:\Users\Shkotov\AppData\Local\zxcoal.dll', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\MoonWiki\ml.py', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\ARMATE~1\ml.py', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Adobemnr\AdobeL.exe', '32');
DeleteFile('C:\Program Files\baidu\BindEx.exe', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Mail.Ru\Agent\magent.exe', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdcont.exe', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdrpo2t.exe', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\amdrpo2t.exe.sha1', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvidload.exe', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nvidload.exe.sha1', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\ARMATE~1\app.py', '32');
DeleteFile('C:\Users\Shkotov\AppData\Roaming\MoonWiki\app.py', '32');
DeleteFileMask('c:\users\shkotov\appdata\roaming\moonwiki', '*', true);
DeleteFileMask('c:\users\shkotov\appdata\roaming\armate~1', '*', true);
DeleteFileMask('c:\users\shkotov\appdata\roaming\adobemnr', '*', true);
DeleteFileMask('c:\program files\baidu', '*', true);
DeleteFileMask('c:\users\shkotov\appdata\roaming\mail.ru', '*', true);
DeleteDirectory('c:\users\shkotov\appdata\roaming\moonwiki');
DeleteDirectory('c:\users\shkotov\appdata\roaming\armate~1');
DeleteDirectory('c:\users\shkotov\appdata\roaming\adobemnr');
DeleteDirectory('c:\program files\baidu');
DeleteDirectory('c:\users\shkotov\appdata\roaming\mail.ru');
ExecuteFile('schtasks.exe', '/delete /TN "Adobe.Updater.Min" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "armaterget" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "armaterget2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "MoonWiki" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "MoonWiki2" /F', 0, 15000, true);
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MoonWiki');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'zxcoal');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'armaterget');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'AdobeUpdaterMin');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run-', 'baidu');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MAgent', 'command');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(1);
ExecuteRepair(2);
ExecuteRepair(23);
ExecuteRepair(4);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится.