begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\users\1288~1\appdata\local\temp\067b.tmp');
TerminateProcessByName('c:\users\Лена\appdata\local\temp\7647.tmp.exe');
StopService('netfilter2');
StopService('SvcHost Service Host');
QuarantineFile('C:\Users\Лена\AppData\Local\xpon\xpon.exe','');
QuarantineFile('C:\Users\Лена\AppData\Local\wupdate\wupdate.exe','');
QuarantineFile('C:\Users\Лена\AppData\Local\SearchGo\searchgo.exe','');
QuarantineFile('C:\Users\Лена\AppData\Local\PowerMonitor\PowerMonitor.exe','');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Tortoise\TortoiseOverlay.dll','');
QuarantineFile('C:\WINDOWS\system32\drivers\xpon.sys','');
QuarantineFile('c:\users\1288~1\appdata\local\temp\067b.tmp', '');
QuarantineFile('c:\users\Лена\appdata\local\temp\7647.tmp.exe', '');
QuarantineFile('C:\Windows\Microsoft\svchost.exe', '');
QuarantineFile('C:\Users\Лена\AppData\Local\Kometa\StartButton\kometastartvx86.exe', '');
QuarantineFile('C:\Users\Лена\AppData\Local\Temp\1jfuweif.exe', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\msi.exe', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk', '');
QuarantineFile('C:\Users\Public\Desktop\Google Chrome.lnk', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk', '');
QuarantineFile('C:\Users\Лена\Desktop\Вoйти в Интeрнет.lnk', '');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk', '');
QuarantineFile('C:\Users\Лена\Desktop\Амиго.lnk', '');
QuarantineFile('C:\Users\Лена\Desktop\Одноклассники.lnk', '');
QuarantineFile('C:\Users\Лена\Desktop\ВКонтакте.lnk', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Одноклассники.lnk', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ВКонтакте.lnk', '');
QuarantineFile('C:\Users\Лена\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Амиго.lnk', '');
DeleteFile('C:\Users\Лена\AppData\Roaming\Tortoise\TortoiseOverlay.dll','32');
DeleteFile('C:\Users\Лена\AppData\Local\PowerMonitor\PowerMonitor.exe','32');
DeleteFile('C:\Users\Лена\AppData\Local\SearchGo\searchgo.exe','32');
DeleteFile('C:\Users\Лена\AppData\Local\wupdate\wupdate.exe','32');
DeleteFile('C:\Users\Лена\AppData\Local\xpon\xpon.exe','32');
DeleteFile('C:\WINDOWS\system32\drivers\xpon.sys','32');
DeleteFile('c:\users\1288~1\appdata\local\temp\067b.tmp', '32');
DeleteFile('c:\users\Лена\appdata\local\temp\7647.tmp.exe', '32');
DeleteFile('C:\Windows\Microsoft\svchost.exe', '32');
DeleteFile('C:\Users\Лена\AppData\Local\Kometa\StartButton\kometastartvx86.exe', '32');
DeleteFile('C:\Users\Лена\AppData\Local\Temp\1jfuweif.exe', '32');
DeleteFile('C:\Users\Лена\AppData\Roaming\Microsoft\msi.exe', '32');
ExecuteFile('schtasks.exe', '/delete /TN "MSI" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Notepad" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "PowerMonitor" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SearchGo Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "wupdate" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "xpon" /F', 0, 15000, true);
DeleteService('netfilter2');
DeleteService('SvcHost Service Host');
DelBHO('{2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC}');
DelBHO('{598AEFC6-DD3C-4A63-9AC3-53FCF6155931}');
DelCLSID('{CBF88FC2-F150-4F29-BC80-CE30EFD1B62C}');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','xdrnuxkvzf');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(3);
BC_Activate;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
