Код:
{Перед использованием скрипта убедиться, что в системе не установлены упомянутые в скрипте антивирусы. Автор скрипта: regist}
var
vir_pd_folders, vir_o_folders, PD_AV_folders, PF_AV_folders, O_AV_folders, L_SID : TStringList;
fname, OSVer: string;
i: integer;
procedure FillList;
begin
PD_AV_folders := TStringList.Create;
PD_AV_folders.Add('360TotalSecurity');
PD_AV_folders.Add('360safe');
PD_AV_folders.Add('AVAST Software');
PD_AV_folders.Add('Avg');
PD_AV_folders.Add('Avira');
PD_AV_folders.Add('Doctor Web');
PD_AV_folders.Add('ESET');
PD_AV_folders.Add('Indus');
PD_AV_folders.Add('Kaspersky Lab Setup Files');
PD_AV_folders.Add('Kaspersky Lab');
PD_AV_folders.Add('McAfee');
PD_AV_folders.Add('Norton');
PD_AV_folders.Add('grizzly');
PF_AV_folders := TStringList.Create;
PF_AV_folders.Add('360');
PF_AV_folders.Add('AVAST Software');
PF_AV_folders.Add('AVG');
PF_AV_folders.Add('ByteFence');
PF_AV_folders.Add('COMODO');
PF_AV_folders.Add('Cezurity');
PF_AV_folders.Add('Common Files\McAfee');
PF_AV_folders.Add('ESET');
PF_AV_folders.Add('Enigma Software Group');
PF_AV_folders.Add('GRIZZLY Antivirus');
PF_AV_folders.Add('Internet Explorer\bin');
PF_AV_folders.Add('Kaspersky Lab');
PF_AV_folders.Add('Malwarebytes');
PF_AV_folders.Add('Microsoft JDX');
PF_AV_folders.Add('Panda Security');
PF_AV_folders.Add('SpyHunter');
O_AV_folders := TStringList.Create;
O_AV_folders.Add('%SYSTEMDRIVE%'+'\AdwCleaner');
O_AV_folders.Add('%SYSTEMDRIVE%'+'\KVRT_Data');
vir_pd_folders := TStringList.Create;
vir_pd_folders.Add('Microsoft\Check');
vir_pd_folders.Add('Microsoft\Intel');
vir_pd_folders.Add('Microsoft\temp');
vir_pd_folders.Add('RealtekHD');
vir_pd_folders.Add('RunDLL');
vir_pd_folders.Add('Setup');
vir_pd_folders.Add('System32');
vir_pd_folders.Add('Windows');
vir_pd_folders.Add('WindowsTask');
vir_pd_folders.Add('bebca3bc90');
vir_pd_folders.Add('install');
vir_pd_folders.Add('microsoft\clr_optimization_v4.0.30318_64');
vir_o_folders := TStringList.Create;
vir_o_folders.Add('%PF%\RDP Wrapper');
vir_o_folders.Add('%SYSTEMDRIVE%\Config.Msi');
vir_o_folders.Add('%windir%\Fonts\Mysql');
vir_o_folders.Add('%windir%\NetworkDistribution');
vir_o_folders.Add('%windir%\speechstracing');
end;
procedure Del_AV_folders(path:string; AFL : TStringList);
begin
for i := 0 to AFL.Count - 1 do
begin
fname := NormalDir(path + AFL[i]);
if DirectoryExists(fname) then
begin
AddToLog(fname + ' - Exists');
FSResetSecurity(fname);
DeleteDirectory(fname);
end;
end;
end;
procedure Del_vir_folders(path:string; AFL : TStringList);
begin
for i := 0 to AFL.Count - 1 do
begin
fname := NormalDir(path + AFL[i]);
if DirectoryExists(fname) then
begin
AddToLog(fname + ' - Exists');
FSResetSecurity(fname);
QuarantineFileF(fname, '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0, 0);
DeleteFileMask(fname, '*', true);
DeleteDirectory(fname);
end;
end;
end;
procedure Del_c_rdp;
var c_rdp: string;
begin
c_rdp := NormalDir('%SYSTEMDRIVE%'+'\rdp');
if DirectoryExists(NormalDir(c_rdp)) then
begin
AddToLog(c_rdp + ' - Exists');
FSResetSecurity(c_rdp);
QuarantineFileF(c_rdp, '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*, *.rar', true, '', 0, 0);
DeleteFile(c_rdp + '..txt');
DeleteFile(c_rdp + 'bat.bat');
DeleteFile(c_rdp + 'pause.bat');
DeleteFile(c_rdp + 'run.vbs');
DeleteFile(c_rdp + 'install.vbs');
DeleteFile(c_rdp + 'fsuc.vbs');
DeleteFile(c_rdp + 'db.rar');
DeleteFile(c_rdp + 'Rar.exe');
DeleteFile(c_rdp + 'RDPWInst.exe');
DeleteFile(c_rdp + 'Privatek.exe');
DeleteDirectory(c_rdp);
end;
end;
procedure DelF;
var ProgramData, ProgramFiles, ProgramFiles86: string;
begin
FillList;
ProgramData := GetEnvironmentVariable('ProgramData') + '\';
ProgramFiles := NormalDir('%PF%');
ProgramFiles86 := NormalDir('%PF% (x86)');
Del_AV_folders(ProgramData, PD_AV_folders);
Del_AV_folders(ProgramFiles, PF_AV_folders);
Del_AV_folders(ProgramFiles86, PF_AV_folders);
Del_AV_folders('', O_AV_folders);
Del_vir_folders(ProgramData, vir_pd_folders);
Del_vir_folders('', vir_o_folders);
Del_c_rdp;
PD_AV_folders.Free;
PF_AV_folders.Free;
O_AV_folders.Free;
vir_pd_folders.Free;
vir_o_folders.Free;
if FileExists (ProgramData + 'RDPWinst.exe') then DeleteFile(ProgramData + 'RDPWinst.exe');
if FileExists ('%windir%'+'\WrpYGF74DrEm.ini') then DeleteFile('%windir%'+'\WrpYGF74DrEm.ini');
end;
procedure DelTasks;
var
L_Tasks : TStringList;
begin
L_Tasks := TStringList.Create;
L_Tasks.Add('Microsoft\Windows\Wininet\Cleaner');
L_Tasks.Add('Microsoft\Windows\Wininet\RealtekHDControl');
L_Tasks.Add('Microsoft\Windows\Wininet\RealtekHDStartUP');
L_Tasks.Add('Microsoft\Windows\Wininet\Taskhost');
L_Tasks.Add('Microsoft\Windows\Wininet\Taskhostw');
for i := 0 to L_Tasks.Count - 1 do
begin
DeleteSchedulerTask(L_Tasks[i]);
end;
L_Tasks.Free;
end;
procedure Del_DisallowRun(SID_Name : string);
const
PolExplKey = '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\';
DR = 'DisallowRun';
begin
if (RegKeyExists('HKEY_USERS', SID_Name + PolExplKey + DR)) then
begin
AddToLog('HKEY_USERS\' + SID_Name + PolExplKey + DR + ' - Exists');
BackupRegKey('HKEY_USERS', SID_Name + PolExplKey, DR + SID_Name);
RegKeyDel('HKEY_USERS', SID_Name + PolExplKey + DR);
RegKeyParamDel('HKEY_USERS', SID_Name + PolExplKey, DR);
end;
end;
procedure swprv;
begin
ExecuteFile('sc.exe', 'create "swprv" binpath= "%SystemRoot%\System32\svchost.exe -k swprv" type= own start= demand depend= RPCSS', 0, 15000, true);
RegKeyParamDel ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'wow64');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'Description', '@%SystemRoot%\System32\swprv.dll,-102');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'DisplayName', '@%SystemRoot%\System32\swprv.dll,-103');
RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'ServiceSidType', '1');
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%Systemroot%\System32\swprv.dll');
OSVer := RegKeyStrParamRead('HKLM','SOFTWARE\Microsoft\Windows NT\CurrentVersion','CurrentVersion');
if OSVer > '6.1' then RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDllUnloadOnStop', '1');;
ExecuteFile('sc.exe', 'privs "swprv" SeBackupPrivilege/SeChangeNotifyPrivilege/SeCreateGlobalPrivilege/SeCreatePermanentPrivilege/SeImpersonatePrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeIncreaseBasePriorityPrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeTcbPrivilege', 0, 15000, true);
ExecuteFile('net.exe', 'start "swprv"', 0, 15000, true);
end;
procedure AV_block_remove;
begin
clearlog;
// SetupAVZ('debug=y');
if GetAVZVersion < 5.18 then begin
ShowMessage('Пожалуйста, используйте актуальную версию AVZ, например, из папки AutoLogger-а.'+#13#10+'Please use actual AVZ version, for example from AutoLogger’s folder.');
AddToLog('Текущая версия - '+FormatFloat('#0.00', GetAVZVersion));
exitAVZ;
end;
StopService('RManService');
DelF;
L_SID := TStringList.Create;
RegKeyEnumKey('HKEY_USERS', '\', L_SID);
for i:= 0 to L_SID.Count-1 do
Del_DisallowRun(L_SID[i]);
L_SID.Free;
DelTasks;
DeleteService('RManService', true);
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\services\TermService\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%SystemRoot%\System32\termsrv.dll');
swprv;
BackupRegKey('HKLM', 'System\Remote Manipulator System', 'RMS');
RegKeyDel('HKLM', 'System\Remote Manipulator System');
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="allow RDP" protocol=tcp localport=3389', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=445', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=445', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=139', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=139', 0, 15000, true);
ExecuteFile('net.exe', 'user john /delete', 0, 15000, true);
SaveLog(GetAVZDirectory +'AV_block_remove.log');
ExecuteWizard('SCU', 2, 2, true);
ExecuteSysClean;
end;
begin
DeleteService('aswStm');
DeleteFile('C:\Windows\system32\drivers\aswStm.sys','64');
AV_block_remove;
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
RebootWindows(false);
end.
Компьютер перезагрузится.
Ответить с цитированием
вроде начало что то проверять потом выдало "resrv32.exe"ошибка(0*000012d)жму"ок"окно не закрывается,
!!!