Код:
begin
TerminateProcessByName('c:\windows\syswow64\rundll32.exe');
TerminateProcessByName('C:\Program Files\cmdidx\cmdidx.exe');
StopService('cmdidx');
StopService('urhductproauctpro');
QuarantineFileF('C:\Users\Радийчук\AppData\Local\Total Component', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\Airtostrong', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\caMyciloP', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\ppt', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\Users\Радийчук\AppData\Local\profitsaver', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\Users\Радийчук\AppData\Local\SweetLabs App Platform', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFile('C:\Program Files\cmdidx\cmdidx.exe', '');
QuarantineFile('C:\Users\D1FC~1\AppData\Local\Temp\0KrakenDevProps.dll', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\Total Component\{71F63486-1021-D3F0-3FC5-4B722D11793C}\TotalComponent.dll', '');
QuarantineFile('C:\ProgramData\Airtostrong\Airtostrong.exe', '');
QuarantineFile('C:\ProgramData\ApplicationHosting\ApplicationHosting.exe', '');
QuarantineFile('C:\ProgramData\caMyciloP\caMyciloP.exe', '');
QuarantineFile('C:\Program Files (x86)\84E0CCC8-1452876550-11E3-B727-448A5BB7D86A\knsq73C0.tmp', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\Toughcan.exe', '');
QuarantineFile('C:\Windows\system32\drivers\swsedrvr_vw_1_10_0_25.sys', '');
QuarantineFile('C:\Program Files (x86)\ppt\Uninst.exe', '');
QuarantineFile('C:\Users\Радийчук\AppData\Roaming\MyDesktop\qweeeCL.exe', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\profitsaver\rft_sb.exe', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\profitsaver\config.json', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\Pokki\Engine\inspector', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\Pokki\Engine\ServiceHostApp.exe', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe', '');
QuarantineFile('C:\ProgramData\caMyciloP\QvoCof.dll', '');
QuarantineFile('C:\ProgramData\Tmp0x0x\P', '');
QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '');
QuarantineFile('C:\Program Files\Sound+\Sound+.exe', '');
QuarantineFile('C:\ProgramData\caMyciloP\LatNambam.dll', '');
QuarantineFile('C:\Users\Радийчук\AppData\Local\Total Component\{71F63486-1021-D3F0-3FC5-4B722D11793C}\xysa.dll', '');
QuarantineFile('C:\Users\Радийчук\AppData\Roaming\WindowsUpdater\Updater.exe', '');
QuarantineFile('C:\Users\Радийчук\appdata\roaming\aspackage\aspackage.exe', '');
DeleteFile('C:\Program Files\cmdidx\cmdidx.exe', '32');
DeleteFile('C:\Users\D1FC~1\AppData\Local\Temp\0KrakenDevProps.dll', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\Total Component\{71F63486-1021-D3F0-3FC5-4B722D11793C}\TotalComponent.dll', '32');
DeleteFile('C:\ProgramData\Airtostrong\Airtostrong.exe', '32');
DeleteFile('C:\ProgramData\ApplicationHosting\ApplicationHosting.exe', '32');
DeleteFile('C:\ProgramData\caMyciloP\caMyciloP.exe', '32');
DeleteFile('C:\Program Files (x86)\84E0CCC8-1452876550-11E3-B727-448A5BB7D86A\knsq73C0.tmp', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\Toughcan.exe', '32');
DeleteFile('C:\Windows\system32\drivers\swsedrvr_vw_1_10_0_25.sys', '32');
DeleteFile('C:\Program Files (x86)\ppt\Uninst.exe', '32');
DeleteFile('C:\Users\Радийчук\AppData\Roaming\MyDesktop\qweeeCL.exe', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\profitsaver\rft_sb.exe', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\profitsaver\config.json', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\Pokki\Engine\inspector', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\Pokki\Engine\ServiceHostApp.exe', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe', '32');
DeleteFile('C:\ProgramData\caMyciloP\QvoCof.dll', '32');
DeleteFile('C:\ProgramData\Tmp0x0x\P', '32');
DeleteFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '32');
DeleteFile('C:\Program Files\Sound+\Sound+.exe', '32');
DeleteFile('C:\ProgramData\caMyciloP\LatNambam.dll', '32');
DeleteFile('C:\Users\Радийчук\AppData\Local\Total Component\{71F63486-1021-D3F0-3FC5-4B722D11793C}\xysa.dll', '32');
DeleteFile('C:\Users\Радийчук\AppData\Roaming\WindowsUpdater\Updater.exe', '32');
DeleteFile('C:\Users\Радийчук\appdata\roaming\aspackage\aspackage.exe', '32');
DeleteService('cmdidx');
DeleteService('Airtostrong');
DeleteService('ApplicationHosting');
DeleteService('caMyciloP');
DeleteService('sywoderyzbt');
DeleteService('urhductproauctpro');
DeleteService('swsedrvr_vw_1_10_0_25');
DeleteFileMask('C:\Program Files\cmdidx', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Local\Total Component', '*', true);
DeleteFileMask('C:\ProgramData\Airtostrong', '*', true);
DeleteFileMask('C:\ProgramData\ApplicationHosting', '*', true);
DeleteFileMask('C:\ProgramData\caMyciloP', '*', true);
DeleteFileMask('C:\Program Files (x86)\ppt', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Roaming\MyDesktop', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Local\profitsaver', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Local\Pokki', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Local\SweetLabs App Platform', '*', true);
DeleteFileMask('C:\ProgramData\Tmp0x0x', '*', true);
DeleteFileMask('C:\Program Files\SpaceSoundPro', '*', true);
DeleteFileMask('C:\Program Files\Sound+', '*', true);
DeleteFileMask('C:\Users\Радийчук\AppData\Roaming\WindowsUpdater', '*', true);
DeleteFileMask('C:\Users\Радийчук\appdata\roaming\aspackage', '*', true);
DeleteDirectory('C:\Program Files\cmdidx');
DeleteDirectory('C:\Users\Радийчук\AppData\Local\Total Component');
DeleteDirectory('C:\ProgramData\Airtostrong');
DeleteDirectory('C:\ProgramData\ApplicationHosting');
DeleteDirectory('C:\ProgramData\caMyciloP');
DeleteDirectory('C:\Program Files (x86)\ppt');
DeleteDirectory('C:\Users\Радийчук\AppData\Roaming\MyDesktop');
DeleteDirectory('C:\Users\Радийчук\AppData\Local\profitsaver');
DeleteDirectory('C:\Users\Радийчук\AppData\Local\Pokki');
DeleteDirectory('C:\Users\Радийчук\AppData\Local\SweetLabs App Platform');
DeleteDirectory('C:\ProgramData\Tmp0x0x');
DeleteDirectory('C:\Program Files\SpaceSoundPro');
DeleteDirectory('C:\Program Files\Sound+');
DeleteDirectory('C:\Users\Радийчук\AppData\Roaming\WindowsUpdater');
DeleteDirectory('C:\Users\Радийчук\appdata\roaming\aspackage');
ExecuteFile('schtasks.exe', '/delete /TN "Total Component" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Total Component2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "WindowsUpdater" /F', 0, 15000, true);
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'pcmgr');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MyDesktop');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'profitsaver');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'Application Restart #3');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'Application Restart #2');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SpaceSoundPro');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Sound+');
ExecuteSysClean;
ExecuteRepair(4);
ExecuteRepair(23);
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.