Код:
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\program files (x86)\adshield\svc.exe');
TerminateProcessByName('c:\program files (x86)\transmission\transmission-daemon.exe');
StopService('adshieldsvc');
StopService('Transmission');
QuarantineFile('C:\Program Files (x86)\AdShield\libcrypto-1_1.dll', '');
QuarantineFile('C:\Program Files (x86)\AdShield\libssl-1_1.dll', '');
QuarantineFile('C:\Program Files (x86)\AdShield\MSVCP140_1.dll', '');
QuarantineFile('c:\program files (x86)\adshield\svc.exe', '');
QuarantineFile('C:\Program Files (x86)\ftHOnQmICHLU2\UGGQYBKzYVTiE.dll', '');
QuarantineFile('C:\Program Files (x86)\NetShield Kit\cli.exe', '');
QuarantineFile('C:\Program Files (x86)\NetShield Kit\netshieldsvc.exe', '');
QuarantineFile('C:\Program Files (x86)\Transmission\libcrypto-1_1.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\libcurl.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\libssl-1_1.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\platforms\qwindows.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5Core.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5DBus.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5Gui.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5Network.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5Widgets.dll', '');
QuarantineFile('C:\Program Files (x86)\Transmission\Qt5WinExtras.dll', '');
QuarantineFile('c:\program files (x86)\transmission\transmission-daemon.exe', '');
QuarantineFile('C:\Program Files (x86)\Transmission\zlib.dll', '');
QuarantineFile('C:\Program Files (x86)\UaoyJbnqSYajSbFVLFR\iDlXZVd.dll', '');
QuarantineFile('C:\Program Files (x86)\ytrCIEiBrvqMC\INjqEHJ.dll', '');
QuarantineFile('C:\ProgramData\QffkVqgUfWqqlSVB\fBEmcet.wsf', '');
QuarantineFile('C:\Users\USER\AppData\Local\Browserupdphenix\Browserupdphenix.exe', '');
QuarantineFile('C:\WINDOWS\OInstall.exe', '');
QuarantineFileF('c:\program files (x86)\fthonqmichlu2', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', false, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\netshield kit', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\transmission', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\uaoyjbnqsyajsbfvlfr', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', false, '', 0 , 0);
QuarantineFileF('c:\program files (x86)\ytrcieibrvqmc', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', false, '', 0 , 0);
QuarantineFileF('C:\ProgramData\Flock', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0, 0);
QuarantineFileF('c:\programdata\qffkvqgufwqqlsvb', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', false, '', 0 , 0);
DeleteFile('C:\Program Files (x86)\AdShield\libcrypto-1_1.dll', '');
DeleteFile('C:\Program Files (x86)\AdShield\libssl-1_1.dll', '');
DeleteFile('C:\Program Files (x86)\AdShield\MSVCP140_1.dll', '');
DeleteFile('c:\program files (x86)\adshield\svc.exe', '');
DeleteFile('C:\Program Files (x86)\ftHOnQmICHLU2\UGGQYBKzYVTiE.dll', '');
DeleteFile('C:\Program Files (x86)\NetShield Kit\cli.exe', '');
DeleteFile('C:\Program Files (x86)\NetShield Kit\netshieldsvc.exe', '');
DeleteFile('C:\Program Files (x86)\Transmission\libcrypto-1_1.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\libcurl.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\libssl-1_1.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\platforms\qwindows.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5Core.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5DBus.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5Gui.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5Network.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5Widgets.dll', '');
DeleteFile('C:\Program Files (x86)\Transmission\Qt5WinExtras.dll', '');
DeleteFile('c:\program files (x86)\transmission\transmission-daemon.exe', '');
DeleteFile('C:\Program Files (x86)\Transmission\zlib.dll', '');
DeleteFile('C:\Program Files (x86)\UaoyJbnqSYajSbFVLFR\iDlXZVd.dll', '');
DeleteFile('C:\Program Files (x86)\ytrCIEiBrvqMC\INjqEHJ.dll', '');
DeleteFile('C:\ProgramData\QffkVqgUfWqqlSVB\fBEmcet.wsf', '');
DeleteFile('C:\Users\USER\AppData\Local\Browserupdphenix\Browserupdphenix.exe', '');
DeleteFile('C:\WINDOWS\system32\Tasks\DownloadStudio Standalone Updater', '64');
DeleteFile('C:\WINDOWS\system32\Tasks\Vkontakte DJ', '64');
ExecuteFile('ipconfig.exe', '/flushdns', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "bOmrzyKsEphEkV" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Browserupdphenix" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KJcHSwvKbKXRfnXwRsJ2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "NetShield Kit scheduled Autoupdate" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "NetShield Kit Self Repair" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "NgFMJCpdYXzip2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "TBSVxIFoxeaJMxbQz2" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "USER" /F', 0, 15000, true);
DeleteService('adshieldsvc');
DeleteService('mrupdsrv');
DeleteService('NetShieldKitSvc');
DeleteService('Rockstar Service');
DeleteService('Transmission');
DeleteFileMask('c:\program files (x86)\adshield', '*', true);
DeleteFileMask('c:\program files (x86)\fthonqmichlu2', '*', false);
DeleteFileMask('c:\program files (x86)\netshield kit', '*', true);
DeleteFileMask('c:\program files (x86)\transmission', '*', true);
DeleteFileMask('c:\program files (x86)\uaoyjbnqsyajsbfvlfr', '*', false);
DeleteFileMask('c:\program files (x86)\ytrcieibrvqmc', '*', false);
DeleteFileMask('C:\ProgramData\Flock', '*', true);
DeleteFileMask('c:\programdata\qffkvqgufwqqlsvb', '*', false);
DeleteFileMask('c:\users\user\appdata\local\browserupdphenix', '*', true);
DeleteDirectory('c:\program files (x86)\adshield');
DeleteDirectory('c:\program files (x86)\fthonqmichlu2');
DeleteDirectory('c:\program files (x86)\netshield kit');
DeleteDirectory('c:\program files (x86)\transmission');
DeleteDirectory('c:\program files (x86)\uaoyjbnqsyajsbfvlfr');
DeleteDirectory('c:\program files (x86)\ytrcieibrvqmc');
DeleteDirectory('C:\ProgramData\Flock');
DeleteDirectory('c:\programdata\qffkvqgufwqqlsvb');
DeleteDirectory('c:\users\user\appdata\local\browserupdphenix');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Discord');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'USER');
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
ExecuteRepair(3);
ExecuteRepair(21);
ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.
Компьютер перезагрузится.