Код:
{ Перед использованием скрипта убедитесь, что в системе не установлены упомянутые в скрипте антивирусы. Автор скрипта: regist. Modification: thyrex}
var ProgramData, ProgramFiles, ProgramFiles86, fname, OSVer: string;
PD_folders, PF_folders, O_folders, L_SID: TStringList;
procedure FillList;
begin
PD_folders:= TStringList.Create;
PD_folders.Add('360TotalSecurity');
PD_folders.Add('360safe');
PD_folders.Add('AVAST Software');
PD_folders.Add('Avg');
PD_folders.Add('Avira');
PD_folders.Add('ESET');
PD_folders.Add('Indus');
PD_folders.Add('Kaspersky Lab Setup Files');
PD_folders.Add('Kaspersky Lab');
PD_folders.Add('MB3Install');
PD_folders.Add('Malwarebytes');
PD_folders.Add('McAfee');
PD_folders.Add('Microsoft\Check');
PD_folders.Add('Microsoft\Intel');
PD_folders.Add('Microsoft\temp');
PD_folders.Add('Norton');
PD_folders.Add('grizzly');
PD_folders.Add('RealtekHD');
PD_folders.Add('RunDLL');
PD_folders.Add('Setup');
PD_folders.Add('System32');
PD_folders.Add('Windows');
PD_folders.Add('WindowsTask');
PD_folders.Add('install');
PD_folders.Add('Doctor Web');
PD_folders.Add('bebca3bc90');
PF_folders:= TStringList.Create;
PF_folders.Add('360');
PF_folders.Add('AVAST Software');
PF_folders.Add('AVG');
PF_folders.Add('ByteFence');
PF_folders.Add('Zaxar');
PF_folders.Add('COMODO');
PF_folders.Add('Cezurity');
PF_folders.Add('Common Files\McAfee');
PF_folders.Add('ESET');
PF_folders.Add('Enigma Software Group');
PF_folders.Add('GRIZZLY Antivirus');
PF_folders.Add('Kaspersky Lab');
PF_folders.Add('Malwarebytes');
PF_folders.Add('Microsoft JDX');
PF_folders.Add('Panda Security');
PF_folders.Add('SpyHunter');
PF_folders.Add('RDP Wrapper');
O_folders:= TStringList.Create;
O_folders.Add(NormalDir('%SYSTEMDRIVE%'+'\AdwCleaner'));
O_folders.Add(NormalDir('%SYSTEMDRIVE%'+'\rdp'));
O_folders.Add(NormalDir('%SYSTEMDRIVE%'+'\KVRT_Data'));
O_folders.Add(NormalDir('%windir%'+'\NetworkDistribution'));
O_folders.Add(NormalDir('%windir%'+'\speechstracing'));
O_folders.Add(NormalDir('%windir%'+'\Fonts\Mysql'));
end;
procedure Del_folders(path: string; AFL: TStringList);
var i, A: integer;
s: string;
begin
for i:= 0 to AFL.Count - 1 do
begin
fname:= NormalDir(path + AFL[i]);
if DirectoryExists(fname)
then
begin
s:= 'Found ' + fname + ' (';
A:= GetAttr(fname);
if A and 4 = 4
then s:= s + 'S';
if A and 2 = 2
then s:= s + 'H';
s:= s + 'D)';
AddToLog(s);
QuarantineFileF(fname, '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0, 0);
DeleteFileMask(fname, '*', true);
FSResetSecurity(fname);
DeleteDirectory(fname);
end;
end;
end;
procedure Del_DisallowRun(SID_Name: string);
const
PolExplKey = '\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\';
DR = 'DisallowRun';
var name1, name2: string;
begin
name1:= SID_Name + PolExplKey;
name2:= name1 + DR;
if (RegKeyExists('HKEY_USERS', name2))
then
begin
AddToLog('HKEY_USERS\' + name2 + ' - Exists');
BackupRegKey('HKEY_USERS', name1, DR + SID_Name);
RegKeyDel('HKEY_USERS', name2);
RegKeyParamDel('HKEY_USERS', name1, DR);
end;
end;
procedure swprv;
begin
ExecuteFile('sc.exe', 'create "swprv" binpath= "%SystemRoot%\System32\svchost.exe -k swprv" type= own start= demand depend= RPCSS', 0, 15000, true);
RegKeyParamDel ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'wow64');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'Description', '@%SystemRoot%\System32\swprv.dll,-102');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'DisplayName', '@%SystemRoot%\System32\swprv.dll,-103');
RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'ServiceSidType', '1');
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%Systemroot%\System32\swprv.dll');
OSVer := RegKeyStrParamRead('HKLM','SOFTWARE\Microsoft\Windows NT\CurrentVersion','CurrentVersion');
if OSVer > '6.1' then RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDllUnloadOnStop', '1');;
ExecuteFile('sc.exe', 'privs "swprv" SeBackupPrivilege/SeChangeNotifyPrivilege/SeCreateGlobalPrivilege/SeCreatePermanentPrivilege/SeImpersonatePrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeIncreaseBasePriorityPrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeTcbPrivilege', 0, 15000, true);
ExecuteFile('net.exe', 'start "swprv"', 0, 15000, true);
end;
procedure AV_block_remove;
var i: integer;
begin
Clearlog;
FillList;
ProgramData:= GetEnvironmentVariable('ProgramData') + '\';
ProgramFiles:= NormalDir('%PF%');
ProgramFiles86:= NormalDir('%PF% (x86)');
Del_folders(ProgramData, PD_folders);
Del_folders(ProgramFiles, PF_folders);
Del_folders(ProgramFiles86, PF_folders);
Del_folders('', O_folders);
L_SID:= TStringList.Create;
RegKeyEnumKey('HKEY_USERS', '\', L_SID);
for i:= 0 to L_SID.Count-1 do
Del_DisallowRun(L_SID[i]);
L_SID.Free;
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\services\TermService\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%SystemRoot%\System32\termsrv.dll');
swprv;
BackupRegKey('HKLM', 'System\Remote Manipulator System', 'RMS');
RegKeyDel('HKLM', 'System\Remote Manipulator System');
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="allow RDP" protocol=tcp localport=3389', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=445', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=445', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=tcp localport=139', 0, 15000, true);
ExecuteFile('netsh.exe', 'advfirewall firewall delete rule name="Port Blocking" protocol=udp localport=139', 0, 15000, true);
if MessageDLG('Удалить пользователя "John" ?'+ #13#10 + 'Если пользователь с таким именем вам не знаком, то нажмите "Да".', mtConfirmation, mbYes+mbNo, 0) = 6
then ExecuteFile('net.exe', 'user john /delete', 0, 15000, true);
PD_folders.Free;
PF_folders.Free;
O_folders.Free;
end;
begin
if GetAVZVersion < 5.18
then
begin
ShowMessage('Пожалуйста, используйте актуальную версию AVZ, например, из папки AutoLogger-а.'+#13#10+'Please use actual AVZ version, for example from AutoLogger’s folder.');
AddToLog('Текущая версия - '+FormatFloat('#0.00', GetAVZVersion));
exitAVZ;
end;
AV_block_remove;
fname:= ProgramData + 'RDPWinst.exe';
if FileExists(fname) then DeleteFile(fname);
fname:= '%windir%'+'\WrpYGF74DrEm.ini';
if FileExists(fname) then DeleteFile(fname);
ExecuteSysClean;
SaveLog(GetAVZDirectory +'AV_block_remove.log');
RebootWindows(false);
end.