begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\program files\amazingtab\packages\4b24e752-7e65-4766-b284-7c4e4807dd6a\stanron.exe');
TerminateProcessByName('c:\programdata\zonsoft\zonsoft.exe');
TerminateProcessByName('c:\program files\8df59000-1447413572-0000-0000-000000000000\hnsr4f89.tmp');
TerminateProcessByName('c:\program files\8df59000-1447413572-0000-0000-000000000000\jnsw2d38.tmp');
TerminateProcessByName('c:\program files\8df59000-1447413572-0000-0000-000000000000\knsea6c8.tmp');
TerminateProcessByName('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\12\plugin.exe');
TerminateProcessByName('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\2\plugin.exe');
TerminateProcessByName('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\8\plugin.exe');
TerminateProcessByName('c:\users\!\appdata\local\8df59000-1447963790-0000-0000-000000000000\qnscddf2.tmp');
TerminateProcessByName('c:\users\!\appdata\local\8df59000-1447420879-0000-0000-000000000000\snsmc2d4.tmp');
StopService('uadatj');
StopService('citevebo');
StopService('hidekoqe');
StopService('piromemi');
StopService('qebovulo');
StopService('zojigity');
QuarantineFile('c:\program files\amazingtab\packages\4b24e752-7e65-4766-b284-7c4e4807dd6a\stanron.exe','');
QuarantineFile('C:\Users\!\AppData\Local\Hostinstaller\3504017527_monster.exe','');
QuarantineFile('C:\Users\!\AppData\Local\Amigo\Application\ok.exe','');
QuarantineFile('C:\Users\!\AppData\Local\Amigo\Application\vk.exe','');
QuarantineFile('C:\Users\!\AppData\Local\Amigo\Application\amigo.exe','');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe','');
QuarantineFile('C:\Program Files\Zaxar\ZaxarLoader.exe','');
QuarantineFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','');
QuarantineFile('C:\Users\!\AppData\Local\Linezooity.exe','');
QuarantineFile('c:\programdata\zonsoft\zonsoft.exe','');
QuarantineFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\hnsr4f89.tmp', '');
QuarantineFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\jnsw2d38.tmp', '');
QuarantineFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\knsea6c8.tmp', '');
QuarantineFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\12\plugin.exe', '');
QuarantineFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\2\plugin.exe', '');
QuarantineFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\8\plugin.exe', '');
QuarantineFile('c:\users\!\appdata\local\8df59000-1447963790-0000-0000-000000000000\qnscddf2.tmp', '');
QuarantineFile('c:\users\!\appdata\local\8df59000-1447420879-0000-0000-000000000000\snsmc2d4.tmp', '');
QuarantineFile('C:\Users\!\AppData\Local\Temp\{D2E16BA8-8216-4B70-BA44-E74E9523E3ED}.dll', '');
QuarantineFile('C:\Users\!\AppData\Roaming\JGSRF.exe', '');
DeleteFile('c:\program files\amazingtab\packages\4b24e752-7e65-4766-b284-7c4e4807dd6a\stanron.exe','32');
DeleteFile('c:\programdata\zonsoft\zonsoft.exe','32');
DeleteFile('C:\Users\!\AppData\Local\Linezooity.exe','32');
DeleteFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','32');
DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe','32');
DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe','32');
DeleteFile('C:\Users\!\AppData\Local\Amigo\Application\amigo.exe','32');
DeleteFile('C:\Users\!\AppData\Local\Amigo\Application\vk.exe','32');
DeleteFile('C:\Users\!\AppData\Local\Amigo\Application\ok.exe','32');
DeleteFile('C:\Users\!\AppData\Local\Hostinstaller\3504017527_monster.exe','32');
DeleteFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\hnsr4f89.tmp', '32');
DeleteFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\jnsw2d38.tmp', '32');
DeleteFile('c:\program files\8df59000-1447413572-0000-0000-000000000000\knsea6c8.tmp', '32');
DeleteFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\12\plugin.exe', '32');
DeleteFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\2\plugin.exe', '32');
DeleteFile('c:\programdata\65ad47d7-2e27-4a5c-b238-26643fdaeb98\plugins\8\plugin.exe', '32');
DeleteFile('c:\users\!\appdata\local\8df59000-1447963790-0000-0000-000000000000\qnscddf2.tmp', '32');
DeleteFile('c:\users\!\appdata\local\8df59000-1447420879-0000-0000-000000000000\snsmc2d4.tmp', '32');
DeleteFile('C:\Users\!\AppData\Local\Temp\{D2E16BA8-8216-4B70-BA44-E74E9523E3ED}.dll', '32');
DeleteFile('C:\Users\!\AppData\Roaming\JGSRF.exe', '32');
ExecuteFile('schtasks.exe', '/delete /TN "JGSRF.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Soft installer" /F', 0, 15000, true);
DeleteService('uadatj');
DeleteService('citevebo');
DeleteService('hidekoqe');
DeleteService('piromemi');
DeleteService('qebovulo');
DeleteService('zojigity');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarGameBrowser');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarLoader');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Timestasks');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\amigo','command');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
(
