begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\program files\03000200-1447609481-0500-0006-000700080009\hnsa9cd8.tmp');
TerminateProcessByName('c:\program files\03000200-1447609481-0500-0006-000700080009\jnsf82a7.tmp');
TerminateProcessByName('c:\program files\03000200-1447609481-0500-0006-000700080009\knsd595e.tmp');
TerminateProcessByName('c:\users\d683~1\appdata\local\temp\nsob401.tmp');
TerminateProcessByName('c:\users\Николай\appdata\local\03000200-1447631133-0500-0006-000700080009\snsubde.tmp');
StopService('buxygiqu');
StopService('decetere');
StopService('ginoquci');
StopService('poqitevo');
StopService('TeamViewer');
StopService('zoqowiqi');
QuarantineFile('C:\Users\Николай\AppData\Local\lcoupon\config.json','');
QuarantineFile('C:\Users\Николай\AppData\Local\lcoupon\lcupstbl.exe','');
QuarantineFile('C:\Program Files\Tencent\QQPCMgr\11.1.16908.217\softaal.sys','');
QuarantineFile('C:\Program Files\Tencent\QQPCMgr\11.1.16908.217\QMUdisk.sys','');
QuarantineFile('C:\ProgramData\Zonsoft\Zonsoft.exe','');
QuarantineFile('C:\Users\Public\Desktop\Googlе Сhrоmе.lnk','');
QuarantineFile('C:\Users\Public\Desktop\Мozillа Firеfoх.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozilla Firеfoх.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Googlе Сhromе.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Мozilla Firеfoх.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Eхрlоrеr.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Ехрlоrеr.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Local\Microsoft\Windows\Application Shortcuts\Chrome\Яндекс.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Local\Microsoft\Windows\Application Shortcuts\Chrome\Яндекс.Почта.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Вконтакте.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Одноклассники.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Вконтакте.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Одноклассники.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Искать в Интернете.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Хрень\Вконтакте.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Хрень\Войти в Интернет.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Хрень\Одноклассники.lnk','');
QuarantineFile('C:\Users\Николай\Pictures\Хрень\Одноклассники.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Амиго\Амиго.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Приложения Амиго\Амиго.Музыка.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Амиго.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\SendTo\МойМир@Mail.ru.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Амиго.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Хрень\Амиго.lnk','');
QuarantineFile('C:\Users\Николай\Pictures\Хрень\Амиго.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZaxarGameBrowser\ZaxarGameBrowser.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZaxarGameBrowser\ZaxarUpdate.lnk','');
QuarantineFile('C:\Users\Николай\Desktop\Хрень\Nеvеrwintеr.lnk','');
QuarantineFile('C:\Users\Public\Desktop\DАEMON Тоols Litе.lnk','');
QuarantineFile('C:\Users\Public\Desktop\Wоrld of Тanks.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite\DАEМON Тools Litе.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Wоrld of Tanks.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZaxarGameBrowser\ZаxarGamеBrоwsеr.lnk','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.emorhc.bat','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.xoferif.bat','');
QuarantineFile('C:\Users\Николай\AppData\Local\chrome.bat','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualcra.bat','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualtd.bat','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualtow.bat','');
QuarantineFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.resworbemagraxaz.bat','');
QuarantineFile('c:\program files\03000200-1447609481-0500-0006-000700080009\hnsa9cd8.tmp', '');
QuarantineFile('c:\program files\03000200-1447609481-0500-0006-000700080009\jnsf82a7.tmp', '');
QuarantineFile('c:\program files\03000200-1447609481-0500-0006-000700080009\knsd595e.tmp', '');
QuarantineFile('c:\users\d683~1\appdata\local\temp\nsob401.tmp', '');
QuarantineFile('c:\users\Николай\appdata\local\03000200-1447631133-0500-0006-000700080009\snsubde.tmp', '');
DeleteFile('C:\ProgramData\Zonsoft\Zonsoft.exe','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\11.1.16908.217\QMUdisk.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\11.1.16908.217\softaal.sys','32');
DeleteFile('C:\Users\Николай\AppData\Local\lcoupon\lcupstbl.exe','32');
DeleteFile('C:\Users\Николай\AppData\Local\lcoupon\config.json','32');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.emorhc.bat','');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.xoferif.bat','');
DeleteFile('C:\Users\Николай\AppData\Local\chrome.bat','');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualcra.bat','');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualtd.bat','');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.rehcnualtow.bat','');
DeleteFile('C:\Users\Николай\AppData\Roaming\Browsers\exe.resworbemagraxaz.bat','');
DeleteFile('c:\program files\03000200-1447609481-0500-0006-000700080009\hnsa9cd8.tmp', '32');
DeleteFile('c:\program files\03000200-1447609481-0500-0006-000700080009\jnsf82a7.tmp', '32');
DeleteFile('c:\program files\03000200-1447609481-0500-0006-000700080009\knsd595e.tmp', '32');
DeleteFile('c:\users\d683~1\appdata\local\temp\nsob401.tmp', '32');
DeleteFile('c:\users\Николай\appdata\local\03000200-1447631133-0500-0006-000700080009\snsubde.tmp', '32');
DeleteService('softaal');
DeleteService('QMUdisk');
DeleteService('Zonsoft');
DeleteService('buxygiqu');
DeleteService('decetere');
DeleteService('ginoquci');
DeleteService('poqitevo');
DeleteService('TeamViewer');
DeleteService('zoqowiqi');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','lcoupon');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Adobe Flash Player SU');
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('poqitevo');
BC_Activate;
ExecuteRepair(3);
ExecuteRepair(4);
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
(
