Код:
begin
TerminateProcessByName('c:\program files (x86)\vtgterredie\cszgcaytlk.exe');
TerminateProcessByName('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\yOHXYPmA_V.exe');
TerminateProcessByName('C:\Users\Ksju\AppData\Local\Temp\F6J9VQPED1\8MY9.exe');
TerminateProcessByName('C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.277.811.0.exe');
StopService('nfstat');
QuarantineFile('C:\Program Files (x86)\deoRkBcMU\iUkxJV.dll', '');
QuarantineFile('C:\Program Files (x86)\MOLP\6260339.exe', '');
QuarantineFile('C:\Program Files (x86)\Multitimer\Multitimer.exe', '');
QuarantineFile('C:\Program Files (x86)\NOOfCcUskYMcdeyIflR\fvYHRME.dll', '');
QuarantineFile('C:\Program Files (x86)\pObWEjsjndqU2\yiVURkjxwJMVs.dll', '');
QuarantineFile('c:\program files (x86)\vtgterredie\cszgcaytlk.exe', '');
QuarantineFile('C:\Program Files (x86)\vTGTErrEdIE\HiaJ7v.dll', '');
QuarantineFile('C:\Program Files (x86)\vTGTErrEdIE\kqh6KABq.dll', '');
QuarantineFile('C:\Program Files (x86)\YaNQOzjyhjQoC\zwixAfy.dll', '');
QuarantineFile('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\p7uUQP_cKa.exe', '');
QuarantineFile('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\yOHXYPmA_V.exe', '');
QuarantineFile('C:\ProgramData\CvclQZOtucyvVSVB\JdHsSsk.wsf', '');
QuarantineFile('C:\Users\Ksju\AppData\Local\Temp\F6J9VQPED1\8MY9.exe', '');
QuarantineFile('C:\Users\Ksju\AppData\Roaming\YoutubeDownloader\python\python3.dll', '');
QuarantineFile('C:\Users\Ksju\AppData\Roaming\YoutubeDownloader\python\python37.dll', '');
QuarantineFile('C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.277.811.0.exe', '');
QuarantineFile('C:\WINDOWS\System32\drivers\nfstat.sys', '');
DeleteFile('C:\Program Files (x86)\deoRkBcMU\iUkxJV.dll', '');
DeleteFile('C:\Program Files (x86)\MOLP\6260339.exe', '64');
DeleteFile('C:\Program Files (x86)\Multitimer\Multitimer.exe', '32');
DeleteFile('C:\Program Files (x86)\NOOfCcUskYMcdeyIflR\fvYHRME.dll', '');
DeleteFile('C:\Program Files (x86)\pObWEjsjndqU2\yiVURkjxwJMVs.dll', '');
DeleteFile('c:\program files (x86)\vtgterredie\cszgcaytlk.exe', '');
DeleteFile('C:\Program Files (x86)\vTGTErrEdIE\HiaJ7v.dll', '');
DeleteFile('C:\Program Files (x86)\vTGTErrEdIE\kqh6KABq.dll', '');
DeleteFile('C:\Program Files (x86)\YaNQOzjyhjQoC\zwixAfy.dll', '');
DeleteFile('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\p7uUQP_cKa.exe', '64');
DeleteFile('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\yOHXYPmA_V.exe', '');
DeleteFile('C:\Program Files\WindowsPowerShell\CQHA6LBNJ39XVZPATG2FVPHN90YF63DWRHF3QN\yOHXYPmA_V.exe', '32');
DeleteFile('C:\ProgramData\CvclQZOtucyvVSVB\JdHsSsk.wsf', '');
DeleteFile('C:\Users\Ksju\AppData\Local\Temp\F6J9VQPED1\8MY9.exe', '');
DeleteFile('C:\Users\Ksju\AppData\Roaming\YoutubeDownloader\python\python3.dll', '');
DeleteFile('C:\Users\Ksju\AppData\Roaming\YoutubeDownloader\python\python37.dll', '');
DeleteFile('C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.277.811.0.exe', '');
DeleteFile('C:\WINDOWS\System32\drivers\nfstat.sys', '');
ExecuteFile('schtasks.exe', '/delete /TN "GItHvXoKUgtwAW" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "LgUiZWCNTEYJs2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "qZkEPNCGHOoYARSao2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "RzmVfSQvlkpVqKr2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "zkqtSUqvflBJtZIfTnB2" /F', 0, 15000, true);
DeleteService('nfstat');
DeleteFileMask('c:\program files (x86)\deorkbcmu', '*', true);
DeleteFileMask('c:\program files (x86)\multitimer', '*', true);
DeleteFileMask('c:\program files (x86)\noofccuskymcdeyiflr', '*', true);
DeleteFileMask('c:\program files (x86)\pobwejsjndqu2', '*', true);
DeleteFileMask('c:\program files (x86)\vtgterredie', '*', true);
DeleteFileMask('c:\program files (x86)\yanqozjyhjqoc', '*', true);
DeleteFileMask('c:\program files\windowspowershell\cqha6lbnj39xvzpatg2fvphn90yf63dwrhf3qn', '*', true);
DeleteFileMask('c:\programdata\cvclqzotucyvvsvb', '*', true);
DeleteFileMask('c:\users\ksju\appdata\local\temp\f6j9vqped1', '*', true);
DeleteDirectory('c:\program files (x86)\deorkbcmu');
DeleteDirectory('c:\program files (x86)\multitimer');
DeleteDirectory('c:\program files (x86)\noofccuskymcdeyiflr');
DeleteDirectory('c:\program files (x86)\pobwejsjndqu2');
DeleteDirectory('c:\program files (x86)\vtgterredie');
DeleteDirectory('c:\program files (x86)\yanqozjyhjqoc');
DeleteDirectory('c:\program files\windowspowershell\cqha6lbnj39xvzpatg2fvphn90yf63dwrhf3qn');
DeleteDirectory('c:\programdata\cvclqzotucyvvsvb');
DeleteDirectory('c:\users\ksju\appdata\local\temp\f6j9vqped1');
DelBHO('{4380B7D5-B068-48A8-9012-70B2490292FB}');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'yOHXYPmA_V.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Multitimer');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'rwzue5lldol');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.