Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdate\mobsync.exe', '');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdate\Updater.exe', '');
QuarantineFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\Live.exe', '');
QuarantineFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\Updater.exe', '');
QuarantineFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\mobsync.exe', '');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\Windows Live\xgydarqywg.exe', '');
QuarantineFile('c:\documents and settings\admin\application data\{55D167AF-C67F-F36C-B3C6-ED2A50EDCC76}\f86eb730.exe', '');
QuarantineFile('c:\documents and settings\localservice\application data\{55D167AF-C67F-F36C-BACE-416359E5603F}\f86eb730.exe', '');
QuarantineFile('D:\autorun.inf', '');
DeleteFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdate\mobsync.exe', '32');
DeleteFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdate\Updater.exe', '32');
DeleteFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\Live.exe', '32');
DeleteFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\Updater.exe', '32');
DeleteFile('C:\Documents and Settings\LocalService\Application Data\WindowsUpdate\mobsync.exe', '32');
DeleteFile('C:\Documents and Settings\Admin\Application Data\Windows Live\xgydarqywg.exe', '32');
DeleteFile('c:\documents and settings\admin\application data\{55D167AF-C67F-F36C-B3C6-ED2A50EDCC76}\f86eb730.exe', '32');
DeleteFile('c:\documents and settings\localservice\application data\{55D167AF-C67F-F36C-BACE-416359E5603F}\f86eb730.exe', '32');
DeleteFile('D:\autorun.inf', '32');
DeleteFile('C:\Documents and Settings\Admin\Рабочий стол\рабочий стол\Скачать dogovor-o-sovmestnoy-meditsinskoy-deyatelnosti.exe.url');
DeleteFileMask('c:\documents and settings\admin\application data\windowsupdate', '*', true);
DeleteFileMask('c:\documents and settings\localservice\application data\windowsupdate', '*', true);
DeleteFileMask('c:\documents and settings\admin\application data\windows live', '*', true);
DeleteFileMask('c:\documents and settings\admin\application data\{55d167af-c67f-f36c-b3c6-ed2a50edcc76}', '*', true);
DeleteFileMask('c:\documents and settings\localservice\application data\{55d167af-c67f-f36c-bace-416359e5603f}', '*', true);
DeleteDirectory('c:\documents and settings\admin\application data\windowsupdate');
DeleteDirectory('c:\documents and settings\localservice\application data\windowsupdate');
DeleteDirectory('c:\documents and settings\admin\application data\windows live');
DeleteDirectory('c:\documents and settings\admin\application data\{55d167af-c67f-f36c-b3c6-ed2a50edcc76}');
DeleteDirectory('c:\documents and settings\localservice\application data\{55d167af-c67f-f36c-bace-416359e5603f}');
ExecuteFile('schtasks.exe', '/delete /TN "C:\WINDOWS\Tasks\{C9C14F9F-EE4F-6F7C-B3C6-ED2A50EDCC76}.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "C:\WINDOWS\Tasks\{C9C14F9F-EE4F-6F7C-BACE-416359E5603F}.job" /F', 0, 15000, true);
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Windows Update Installer', 'command');
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Live Installer');
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Update Installer');
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run', 'Microsoft Sync Center');
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Live');
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'Windows Live');
RegKeyParamDel('HKEY_USERS', 'S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Live Installer');
RegKeyParamDel('HKEY_USERS', 'S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Update Installer');
RegKeyParamDel('HKEY_USERS', 'S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run', 'Microsoft Sync Center');
RegKeyParamDel('HKEY_USERS', 'S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run', 'Windows Live');
RegKeyParamDel('HKEY_USERS', 'S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'Windows Live');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon', 'Taskman');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(1);
ExecuteWizard('TSW', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится.