Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('C:\Program Files (x86)\Rotation\428190386.exe');
TerminateProcessByName('C:\Program Files (x86)\Rotation\612377947.exe');
TerminateProcessByName('C:\Program Files\Hewlett-Packard\3XVSILJ8P53GRG\kXLHCink8w.exe');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-13qpb.tmp\awhtrevkxf0.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-51mhv.tmp\1bei5fvhd3b.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-9oea2.tmp\khmgohgycfm.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-da6rb.tmp\lczuaazddk1.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-ddnj3.tmp\l045jjx0cxi.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-ds1bb.tmp\zhtnfrcltd2.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-est3t.tmp\ixcynhtlkw3.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-m9hd2.tmp\pt0rp2kgxhp.tmp');
TerminateProcessByName('c:\users\0982~1\appdata\local\temp\is-rlr67.tmp\1g5nrcjsnkn.tmp');
TerminateProcessByName('c:\users\Женя\appdata\roaming\002ejuwlyrd\pt0rp2kgxhp.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\bidfl1prcca\l045jjx0cxi.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\byxvokhwjlo\lczuaazddk1.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\czmtnotjlx2\awhtrevkxf0.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\ezx1g2keys5\ixcynhtlkw3.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\j45trjrrnxu\1g5nrcjsnkn.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\ly1zn1dznpz\zhtnfrcltd2.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\n4vz3enxmkl\1bei5fvhd3b.exe');
TerminateProcessByName('c:\users\Женя\appdata\roaming\sbznvpi10sk\khmgohgycfm.exe');
StopService('rcdll');
QuarantineFile('C:\Program Files (x86)\Rotation\428190386.exe', '');
QuarantineFile('C:\Program Files (x86)\Rotation\612377947.exe', '');
QuarantineFile('C:\Program Files (x86)\yXYMSblVdIE\kf9eOEHK.dll', '');
QuarantineFile('C:\Program Files\Hewlett-Packard\3XVSILJ8P53GRG\#gRYDWjxe4.exe', '');
QuarantineFile('C:\Program Files\Hewlett-Packard\3XVSILJ8P53GRG\kXLHCink8w.exe', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-13qpb.tmp\awhtrevkxf0.tmp', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-4JTGL.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-4JTGL.tmp\idp.dll', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-51mhv.tmp\1bei5fvhd3b.tmp', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-9oea2.tmp\khmgohgycfm.tmp', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-A4FHR.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-A4FHR.tmp\idp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-BHLB3.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-BHLB3.tmp\idp.dll', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-da6rb.tmp\lczuaazddk1.tmp', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-ddnj3.tmp\l045jjx0cxi.tmp', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-ds1bb.tmp\zhtnfrcltd2.tmp', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-est3t.tmp\ixcynhtlkw3.tmp', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-JT3LN.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-JT3LN.tmp\idp.dll', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-m9hd2.tmp\pt0rp2kgxhp.tmp', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-OR5M4.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-OR5M4.tmp\idp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-P2ULT.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-P2ULT.tmp\idp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-RKIUU.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-RKIUU.tmp\idp.dll', '');
QuarantineFile('c:\users\0982~1\appdata\local\temp\is-rlr67.tmp\1g5nrcjsnkn.tmp', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-RO3MM.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-RO3MM.tmp\idp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-UON8P.tmp\_isetup\_isdecmp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\is-UON8P.tmp\idp.dll', '');
QuarantineFile('C:\Users\0982~1\AppData\Local\Temp\rcdll.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\002ejuwlyrd\pt0rp2kgxhp.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\bidfl1prcca\l045jjx0cxi.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\byxvokhwjlo\lczuaazddk1.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\czmtnotjlx2\awhtrevkxf0.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\ezx1g2keys5\ixcynhtlkw3.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\j45trjrrnxu\1g5nrcjsnkn.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\ly1zn1dznpz\zhtnfrcltd2.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\n4vz3enxmkl\1bei5fvhd3b.exe', '');
QuarantineFile('c:\users\Женя\appdata\roaming\sbznvpi10sk\khmgohgycfm.exe', '');
DeleteFile('C:\Program Files (x86)\Rotation\428190386.exe', '');
DeleteFile('C:\Program Files (x86)\Rotation\612377947.exe', '');
DeleteFile('C:\Program Files (x86)\Rotation\428190386.exe', '64');
DeleteFile('C:\Program Files (x86)\Rotation\612377947.exe', '64');
DeleteFile('C:\Program Files (x86)\yXYMSblVdIE\kf9eOEHK.dll', '');
DeleteFile('C:\Program Files\Hewlett-Packard\3XVSILJ8P53GRG\#gRYDWjxe4.exe', '64');
DeleteFile('C:\Program Files\Hewlett-Packard\3XVSILJ8P53GRG\kXLHCink8w.exe', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-13qpb.tmp\awhtrevkxf0.tmp', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-4JTGL.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-4JTGL.tmp\idp.dll', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-51mhv.tmp\1bei5fvhd3b.tmp', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-9oea2.tmp\khmgohgycfm.tmp', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-A4FHR.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-A4FHR.tmp\idp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-BHLB3.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-BHLB3.tmp\idp.dll', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-da6rb.tmp\lczuaazddk1.tmp', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-ddnj3.tmp\l045jjx0cxi.tmp', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-ds1bb.tmp\zhtnfrcltd2.tmp', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-est3t.tmp\ixcynhtlkw3.tmp', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-JT3LN.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-JT3LN.tmp\idp.dll', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-m9hd2.tmp\pt0rp2kgxhp.tmp', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-OR5M4.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-OR5M4.tmp\idp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-P2ULT.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-P2ULT.tmp\idp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-RKIUU.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-RKIUU.tmp\idp.dll', '');
DeleteFile('c:\users\0982~1\appdata\local\temp\is-rlr67.tmp\1g5nrcjsnkn.tmp', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-RO3MM.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-RO3MM.tmp\idp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-UON8P.tmp\_isetup\_isdecmp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\is-UON8P.tmp\idp.dll', '');
DeleteFile('C:\Users\0982~1\AppData\Local\Temp\rcdll.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\002ejuwlyrd\pt0rp2kgxhp.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\bidfl1prcca\l045jjx0cxi.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\byxvokhwjlo\lczuaazddk1.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\czmtnotjlx2\awhtrevkxf0.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\ezx1g2keys5\ixcynhtlkw3.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\j45trjrrnxu\1g5nrcjsnkn.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\ly1zn1dznpz\zhtnfrcltd2.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\n4vz3enxmkl\1bei5fvhd3b.exe', '');
DeleteFile('c:\users\Женя\appdata\roaming\sbznvpi10sk\khmgohgycfm.exe', '');
DeleteFile('C:\Users\Женя\Favorites\Links\Интернет.url');
DeleteService('gupdate');
DeleteService('gupdatem');
DeleteService('rcdll');
DeleteFileMask('c:\program files (x86)\yxymsblvdie', '*', true);
DeleteFileMask('c:\program files\hewlett-packard\3xvsilj8p53grg', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\002ejuwlyrd', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\bidfl1prcca', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\byxvokhwjlo', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\czmtnotjlx2', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\ezx1g2keys5', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\j45trjrrnxu', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\ly1zn1dznpz', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\n4vz3enxmkl', '*', true);
DeleteFileMask('c:\users\женя\appdata\roaming\sbznvpi10sk', '*', true);
DeleteDirectory('c:\program files (x86)\yxymsblvdie');
DeleteDirectory('c:\program files\hewlett-packard\3xvsilj8p53grg');
DeleteDirectory('c:\users\женя\appdata\roaming\002ejuwlyrd');
DeleteDirectory('c:\users\женя\appdata\roaming\bidfl1prcca');
DeleteDirectory('c:\users\женя\appdata\roaming\byxvokhwjlo');
DeleteDirectory('c:\users\женя\appdata\roaming\czmtnotjlx2');
DeleteDirectory('c:\users\женя\appdata\roaming\ezx1g2keys5');
DeleteDirectory('c:\users\женя\appdata\roaming\j45trjrrnxu');
DeleteDirectory('c:\users\женя\appdata\roaming\ly1zn1dznpz');
DeleteDirectory('c:\users\женя\appdata\roaming\n4vz3enxmkl');
DeleteDirectory('c:\users\женя\appdata\roaming\sbznvpi10sk');
DelBHO('{0A11C8B7-2333-42A8-8DB1-9A7A91832C55}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', '4zsdsc4g3x3');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'novmvun3z0l');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteRepair(21);
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.