Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\users\kristina\appdata\roaming\imagecropresize\imageed\imageed.exe');
TerminateProcessByName('c:\users\kristina\appdata\local\temp\e.exe');
QuarantineFile('C:\Users\Kristina\appdata\local\searchgo\searchgo.exe','');
QuarantineFile('C:\Users\Kristina\appdata\locallow\searchgo\searchgo.dll','');
QuarantineFile('C:\Users\Kristina\appdata\local\fupdate\fupdate.exe','');
QuarantineFile('C:\Users\Kristina\AppData\Local\syslog\syslog.exe','');
QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe','');
QuarantineFile('c:\users\kristina\appdata\roaming\imagecropresize\imageed\imageed.exe','');
QuarantineFile('c:\users\kristina\appdata\local\temp\e.exe','');
DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe','32');
DeleteFile('C:\Windows\system32\Tasks\fupdate','64');
DeleteFile('C:\Windows\system32\Tasks\Microsoft\KRBUUS\KRB Updater Utility Service','64');
DeleteFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe','32');
DeleteFile('C:\Windows\system32\Tasks\Microsoft\KRBUUS\KRBLNKRUN','64');
DeleteFile('C:\Windows\system32\Tasks\SearchGo Task','64');
DeleteFile('C:\Windows\system32\Tasks\syslog','64');
DeleteFile('C:\Users\Kristina\appdata\local\fupdate\fupdate.exe','32');
DeleteFile('C:\Users\Kristina\appdata\locallow\searchgo\searchgo.dll','32');
DeleteFile('C:\Users\Kristina\appdata\local\searchgo\searchgo.exe','32');
DeleteFile('C:\Users\Kristina\appdata\local\syslog\syslog.exe','32');
DeleteFile('C:\Users\Kristina\appdata\local\temp\e.exe','32');
DeleteFile('C:\Users\Kristina\appdata\roaming\imagecropresize\imageed\imageed.exe','32');
DelBHO('{2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC}');
DelBHO('{598AEFC6-DD3C-4A63-9AC3-53FCF6155931}');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dzrrhafqdv');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ImageEd');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','KRB Updater Utility');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\zlkkojsfsp','command');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
После перезагрузки выполните скрипт: