Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
TerminateProcessByName('c:\program files (x86)\gmsd_ru_005010213\gmsd_ru_005010213.exe');
TerminateProcessByName('c:\users\123\appdata\local\gmsd_ru_005010213\upgmsd_ru_005010213.exe');
TerminateProcessByName('c:\users\123\appdata\roaming\merycemawet\migtuir.exe');
StopService('WindowsMangerProtect');
QuarantineFileF('c:\programdata\timetasks', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\program files\spacesoundpro', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFile('c:\program files (x86)\gmsd_ru_005010213\gmsd_ru_005010213.exe', '');
QuarantineFile('c:\users\123\appdata\local\gmsd_ru_005010213\upgmsd_ru_005010213.exe', '');
QuarantineFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\hnsg3126.tmp', '');
QuarantineFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\jnsp158D.tmp', '');
QuarantineFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\knsr73F5.tmp', '');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe', '');
QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '');
QuarantineFileF('C:\ProgramData\Tmp0x0x\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\ProgramData\AjbQpb\', '*', true, '', 0, 0);
QuarantineFileF('C:\ProgramData\saveittkeep\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFile('C:\Windows\system32\Agammola.dll', '');
QuarantineFile('C:\Windows\system32\Aoeecahn.dll', '');
QuarantineFile('C:\Users\123\AppData\Local\bvxvhxvh\bvxvhxvh.exe', '');
QuarantineFile('C:\ProgramData\saveittkeep\vwHQX.dll', '');
QuarantineFile('C:\Program Files (x86)\baidu\ppt.exe', '');
QuarantineFile('C:\Users\123\AppData\Local\Birds\birds365.exe', '');
QuarantineFile('C:\Users\123\AppData\Local\cuprofit\config.json', '');
QuarantineFile('C:\Users\123\AppData\Local\cuprofit\cuprof_stbl.exe', '');
QuarantineFile('C:\Program Files (x86)\Как\vcnews.exe', '');
QuarantineFile('C:\ProgramData\Tmp0x0x\ProtectWindowsManager.exe', '');
QuarantineFile('C:\Windows\SYSTEM32\DNSAPI.dll', '');
QuarantineFile('c:\users\123\appdata\roaming\merycemawet\migtuir.exe', '');
QuarantineFileF('C:\ProgramData\FlexibleShopper\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\Users\123\AppData\Local\bvxvhxvh\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\Users\123\AppData\Roaming\yoursearching\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFile('C:\ProgramData\AjbQpb\UqNnYkPU0.bat', '');
QuarantineFile('C:\ProgramData\utFdgP\lbHdiEJH0.bat', '');
QuarantineFileF('c:\program files (x86)\pc speed up\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('c:\programdata\rwminipror\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\ProgramData\TimeTasks', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\Users\123\AppData\Local\cuprofit\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFileF('C:\Program Files (x86)\Elex-tech\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFile('C:\ProgramData\trKUxCtoZp\xejWVvJN5.bat', '');
QuarantineFileF('c:\users\123\appdata\roaming\merycemawet\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFile('C:\PROGRA~1\GROOVE~1\Refgy.bat', '');
QuarantineFileF('c:\program files (x86)\rec_ru_179\', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0, 0);
QuarantineFile('C:\PROGRA~1\GROOVE~1\Lakukukj.bat', '');
DeleteFile('c:\users\123\appdata\roaming\merycemawet\migtuir.exe', '32');
DeleteFile('C:\Users\123\AppData\Local\cuprofit\cuprof_stbl.exe', '32');
DeleteFile('C:\Users\123\AppData\Local\cuprofit\config.json', '32');
DeleteFile('C:\Program Files (x86)\baidu\ppt.exe', '32');
DeleteFile('C:\ProgramData\saveittkeep\vwHQX.dll', '32');
DeleteFile('C:\Users\123\AppData\Local\bvxvhxvh\bvxvhxvh.exe', '32');
DeleteFile('C:\Windows\system32\Tasks\bvxvhxvh', '64');
DeleteFile('c:\program files (x86)\gmsd_ru_005010213\gmsd_ru_005010213.exe', '32');
DeleteFile('c:\users\123\appdata\local\gmsd_ru_005010213\upgmsd_ru_005010213.exe', '32');
DeleteFile('C:\ProgramData\Tmp0x0x\ProtectWindowsManager.exe', '32');
DeleteFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\hnsg3126.tmp', '32');
DeleteFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\jnsp158D.tmp', '32');
DeleteFile('C:\Program Files (x86)\E08FDAA2-1448499988-E211-AF1D-AF2717895EAE\knsr73F5.tmp', '32');
DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe', '32');
DeleteFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '32');
DeleteFile('C:\ProgramData\AjbQpb\UqNnYkPU0.bat', '32');
DeleteFile('C:\ProgramData\utFdgP\lbHdiEJH0.bat', '32');
DeleteFile('C:\ProgramData\trKUxCtoZp\xejWVvJN5.bat', '32');
DeleteFile('C:\PROGRA~1\GROOVE~1\Refgy.bat', '32');
DeleteFile('C:\PROGRA~1\GROOVE~1\Lakukukj.bat', '32');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "bvxvhxvh" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Optimizer Pro Schedule" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "{67D4D986-18CC-42A0-912F-E0732F8899E3}" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Raeuobpy" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Ritpo" /F', 0, 15000, true);
DeleteService('WindowsMangerProtect');
DeleteService('nibukeso');
DeleteService('tysyryxe');
DeleteService('wugizunuzbt');
DeleteFileMask('C:\ProgramData\Tmp0x0x\', '*', true);
DeleteFileMask('C:\ProgramData\AjbQpb\', '*', true);
DeleteFileMask('C:\Users\123\AppData\Local\bvxvhxvh\', '*', true);
DeleteFileMask('C:\Users\123\AppData\Roaming\yoursearching\', '*', true);
DeleteFileMask('c:\program files (x86)\pc speed up\', '*', true);
DeleteFileMask('c:\programdata\rwminipror\', '*', true);
DeleteFileMask('C:\Users\123\AppData\Local\cuprofit\', '*', true);
DeleteFileMask('c:\program files (x86)\rec_ru_179\', '*', true);
DeleteFileMask('c:\programdata\timetasks', '*', true);
DeleteFileMask('c:\program files\spacesoundpro', '*', true);
DeleteDirectory('C:\ProgramData\AjbQpb\');
DeleteDirectory('C:\ProgramData\Tmp0x0x\');
DeleteDirectory('C:\Users\123\AppData\Local\bvxvhxvh\');
DeleteDirectory('C:\Users\123\AppData\Roaming\yoursearching\');
DeleteDirectory('c:\program files (x86)\pc speed up\');
DeleteDirectory('C:\Users\123\AppData\Local\cuprofit\');
DeleteDirectory('c:\programdata\rwminipror\');
DeleteDirectory('c:\program files (x86)\rec_ru_179\');
DeleteDirectory('c:\programdata\timetasks');
DeleteDirectory('c:\program files\spacesoundpro');
DelBHO('{4B5AF183-8C0B-9922-7A56-5AFE75211A80}');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'cuprofit');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'apphide');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Timestasks');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'gmsd_ru_005010213');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'upgmsd_ru_005010213.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SpaceSoundPro');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteRepair(3);
ExecuteRepair(4);
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.