Killmasster
Новый пользователь
- Сообщения
- 11
- Реакции
- 0
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\users\123456\appdata\roaming\cpuminer\sgminer\sgm.exe');
TerminateProcessByName('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qqpcrtp.exe');
TerminateProcessByName('c:\users\123456\appdata\roaming\daemon.exe');
SetServiceStart('TSSysKit', 4);
SetServiceStart('TSSKX64', 4);
SetServiceStart('TFsFlt', 4);
SetServiceStart('TAOKernelDriver', 4);
SetServiceStart('TAOAccelerator', 4);
SetServiceStart('QQSysMonX64', 4);
SetServiceStart('QMUdisk', 4);
SetServiceStart('LiveUpdateSvc', 4);
SetServiceStart('QQPCRTP', 4);
StopService('TSSysKit');
StopService('TSSKX64');
StopService('TFsFlt');
StopService('TAOKernelDriver');
StopService('TAOAccelerator');
StopService('QQSysMonX64');
StopService('QMUdisk');
StopService('TAOFrame');
StopService('LiveUpdateSvc');
StopService('QQPCRTP');
QuarantineFile('c:\users\123456\appdata\roaming\cpuminer\sgminer\sgm.exe', '');
QuarantineFile('Uninstaller\IObitUninstaler.exe', '');
QuarantineFile('C:\Program Files (x86)\IObit\IObit', '');
QuarantineFile('C:\Users\123456\AppData\Local\Hostinstaller\3799319150_monster.exe', '');
QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '');
QuarantineFile('C:\Users\123456\AppData\Local\Browsers\browser2.bat', '');
QuarantineFile('C:\Users\123456\AppData\Roaming\cpuminer\sgminer\start.cmd', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\FileSmash\QMSoftExt.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMContextScan.dll', '');
QuarantineFile('C:\Users\123456\AppData\Local\likecoupon\config.json', '');
QuarantineFile('C:\Users\123456\AppData\Local\likecoupon\stub.exe', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCTRAY.EXE', '');
QuarantineFile('C:\Program Files (x86)\Zaxar\timetasks.exe', '');
QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe', '');
QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe', '');
QuarantineFile('C:\ProgramData\JWdsManProJ\WdsManPro.exe', '');
QuarantineFile('C:\Program Files (x86)\34443437-1442427556-3433-4145-3731FFFFFFFF\knslFE84.tmpfs', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAOFrame.exe', '');
QuarantineFile('C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKit64.sys', '');
QuarantineFile('C:\Windows\System32\drivers\tsskx64.sys', '');
QuarantineFile('C:\Windows\system32\Drivers\TFsFltX64.sys', '');
QuarantineFile('C:\Windows\System32\Drivers\TAOKernel64.sys', '');
QuarantineFile('C:\Windows\system32\Drivers\TAOAccelerator64.sys', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUdisk64.sys', '');
QuarantineFile('C:\ProgramData\Tencent\TSVulFw\TSVulFW.DAT', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSWebMon.dat', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKitProxy.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\2.0.10604.1824\tpktt.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\2.0.10604.1824\tpkreport.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\2.0.10604.1824\tpkcom.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\1.0.0.1\tpkproxy.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVInterface.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVEng.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tave.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVCache.dll', '');
QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\sxcombase.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\sqlite.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\SoftMgr\processlogdll.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\RefuseInject.DLL', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCHardware.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUl.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMTrayPlugin\QMPerfCtrl\QMPerf.dll', '');
QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmsysrepprov.dll', '');
QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmscripthost.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMSafeBoxHelperDll.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMRtpDLL.dll', '');
QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmrtpcontroller.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMRtpCheck.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMIpc.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSService.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSPolicyEng.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSHeart.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMFileMon.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMExt.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMEmMat.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMDns.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMCommon.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMAVProxy.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMAssocScan.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\ptrate.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMRepairPlugin.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMHipsEngine.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMCloudInter\QMCloudInter.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMBDScanner.dat', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\oDayProtect.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\dr.dll', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\communic.dll', '');
QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qqpcrtp.exe', '');
QuarantineFile('c:\users\123456\appdata\roaming\daemon.exe', '');
QuarantineFileF('c:\users\123456\appdata\roaming\cpuminer', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\IObit', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\AnyProtectEx', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\Tencen', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\123456\AppData\Local\likecoupon', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\Zaxar', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\Tencen', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\JWdsManProJ', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\Browsers\*.bat', '*', true, '', 0 , 0);
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\communic.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\dr.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\oDayProtect.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMBDScanner.dat', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMCloudInter\QMCloudInter.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMHipsEngine.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMRepairPlugin.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\ptrate.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMAssocScan.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMAVProxy.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMCommon.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMDns.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMEmMat.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMExt.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMFileMon.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSHeart.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSPolicyEng.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMHIPSService.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMNetworkMgr.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMRtpCheck.dll', '32');
DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmrtpcontroller.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMRtpDLL.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMSafeBoxHelperDll.dll', '32');
DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmscripthost.dll', '32');
DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\qmsysrepprov.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMTrayPlugin\QMPerfCtrl\QMPerf.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUl.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCHardware.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\RefuseInject.DLL', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\SoftMgr\processlogdll.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\sqlite.dll', '32');
DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.11.16588.235\sxcombase.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVCache.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tave.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVEng.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAVInterface.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\1.0.0.1\tpkproxy.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\2.0.10604.1824\tpkcom.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\tpk\2.0.10604.1824\tpktt.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKitProxy.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSWebMon.dat', '32');
DeleteFile('C:\ProgramData\Tencent\TSVulFw\TSVulFW.DAT', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUdisk64.sys', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys', '32');
DeleteFile('C:\Windows\system32\Drivers\TAOAccelerator64.sys', '32');
DeleteFile('C:\Windows\system32\Drivers\TFsFltX64.sys', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKit64.sys', '32');
DeleteFile('C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRTP.exe', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAOFrame.exe', '32');
DeleteFile('C:\Program Files (x86)\34443437-1442427556-3433-4145-3731FFFFFFFF\knslFE84.tmpfs', '32');
DeleteFile('C:\ProgramData\JWdsManProJ\WdsManPro.exe', '32');
DeleteFile('C:\Windows\system32\drivers\tsskx64.sys', '32');
DeleteFile('C:\Windows\system32\Drivers\TAOKernel64.sys', '32');
DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe', '32');
DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe', '32');
DeleteFile('C:\Program Files (x86)\Zaxar\timetasks.exe', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCTRAY.EXE', '32');
DeleteFile('C:\Users\123456\AppData\Local\likecoupon\stub.exe', '32');
DeleteFile('C:\Users\123456\AppData\Local\likecoupon\config.json', '32');
DeleteFile('C:\Users\123456\AppData\Roaming\daemon.exe', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMContextScan.dll', '32');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\FileSmash\QMSoftExt.dll', '32');
DeleteFile('C:\Users\123456\AppData\Roaming\cpuminer\sgminer\start.cmd', '32');
DeleteFile('C:\Users\123456\AppData\Local\Browsers\browser2.bat', '32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job', '32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP1', '64');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP2', '64');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP3', '64');
DeleteFile('C:\Windows\system32\Tasks\Soft installer', '64');
DeleteFile('C:\Users\123456\AppData\Local\Hostinstaller\3799319150_monster.exe', '32');
DeleteFile('C:\Windows\system32\Tasks\Uninstaller_SkipUac_123456', '64');
DeleteFile('C:\Program Files (x86)\IObit\IObit', '32');
DeleteFile('Uninstaller\IObitUninstaler.exe', '32');
DeleteFile('c:\users\123456\appdata\roaming\cpuminer\sgminer\sgm.exe', '32');
DeleteService('TSSysKit');
DeleteService('TSSKX64');
DeleteService('TFsFlt');
DeleteService('TAOKernelDriver');
DeleteService('TAOAccelerator');
DeleteService('QQSysMonX64');
DeleteService('QMUdisk');
DeleteService('WdsManPro');
DeleteService('vulobewo');
DeleteService('TAOFrame');
DeleteService('LiveUpdateSvc');
DeleteService('QQPCRTP');
DeleteFileMask('C:\Program Files (x86)\IObit', '*', true);
DeleteFileMask('C:\Program Files (x86)\AnyProtectEx', '*', true);
DeleteFileMask('C:\Program Files (x86)\Tencen', '*', true);
DeleteFileMask('C:\Program Files (x86)\Zaxar', '*', true);
DeleteFileMask('C:\ProgramData\Tencen', '*', true);
DeleteFileMask('C:\ProgramData\JWdsManProJ', '*', true);
DeleteFileMask('C:\ProgramData\Browsers\*.bat', '*', true);
DeleteDirectory('C:\Program Files (x86)\IObit', '');
DeleteDirectory('C:\Program Files (x86)\AnyProtectEx', '');
DeleteDirectory('C:\Program Files (x86)\Tencen', '');
DeleteDirectory('C:\Program Files (x86)\Zaxar', '');
DeleteDirectory('C:\ProgramData\Tencen', '');
DeleteDirectory('C:\ProgramData\JWdsManProJ', '');
DeleteDirectory('C:\ProgramData\Browsers\*.bat', '');
DelCLSID('{754DF2CE-51E8-4895-B53C-6381418B84AE}');
DelCLSID('{63332668-8CE1-445D-A5EE-25929176714E}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'ZaxarGameBrowser');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'ZaxarLoader');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Timestasks');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'QQPCTray');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'likecoupon');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Daemon');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', '{63332668-8CE1-445D-A5EE-25929176714E}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', '{754DF2CE-51E8-4895-B53C-6381418B84AE}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'gpuminer');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('SCU',2,3,true);
RebootWindows(true);
end.
Нет,не в ручную.это в ручную нужно прописывать скрипт? потому что скопировав он не сохраняется при переходе в безопасный режим((
В папке с остальными логами в папке с AVZ...а где взять этот лог Check_Browsers_LNK.log?
А где CollectionLog.....zip?вот что получилось
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
QuarantineFile('C:\ProgramData\JWdsM', '');
QuarantineFileF('C:\ProgramData\JWdsM', '*', true, '', 0 , 0);
QuarantineFile('C:\Program Files (x86)\Application Assistance\app-helper.exe', '');
QuarantineFile('C:\Program Files (x86)\Application Assistance\app-helper1.exe', '');
QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys', '');
QuarantineFile('C:\Windows\system32\drivers\TAOAccelerator64.sys', '');
QuarantineFile('C:\Windows\system32\drivers\TSSKX64.sys', '');
QuarantineFileF('C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\123456\AppData\Roaming\IObit', '*', true, '', 0 , 0);
QuarantineFile('C:\Windows\system32\drivers\TAOKernel64.sys', '');
QuarantineFile('C:\Windows\system32\drivers\TFsFltX64.sys', '');
QuarantineFileF('C:\ProgramData\Tencent', '*', true, '', 0 , 0);
QuarantineFile('C:\Windows\system32\GroupPolicy\Machine\Registry.pol','');
QuarantineFile('C:\Users\123456\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk','');
QuarantineFile('C:\Users\123456\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk','');
QuarantineFile('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PROТанки MultiPack\Сайт PROТанки в Интернете.url','');
QuarantineFile('C:\Windows\system32\GroupPolicy\Machine\R','');
QuarantineFile('C:\ProgramData\Browsers\browser0.bat', '');
QuarantineFile('C:\ProgramData\Browsers\browser6.bat', '');
QuarantineFile('C:\ProgramData\Browsers\browser4.bat', '');
QuarantineFileF('C:\ProgramData\IObit', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files (x86)\Tencent', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\123456\AppData\Roaming\Tencent', '*', true, '', 0 , 0);
QuarantineFileF('C:\Program Files\Common Files\Tencent', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\TXQMPC', '*', true, '', 0 , 0);
QuarantineFile('C:\Windows\SYSWOW64\drivers\TS888x64.sys', '');
QuarantineFileF('C:\Users\123456\AppData\Roaming\cpuminer', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\123456\AppData\Roaming\istartsurf', '*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat', '*', true, '', 0 , 0);
QuarantineFileF('C:\Users\123456\AppData\Roaming\AnyProtectEx', '*', true, '', 0 , 0);
DeleteFile('C:\ProgramData\JWdsM');
DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys', '32');
DeleteFile('C:\Windows\system32\Drivers\TFsFltX64.sys', '32');
DeleteFile('C:\Windows\system32\drivers\tsskx64.sys', '32');
DeleteFile('C:\Program Files (x86)\Application Assistance\app-helper1.exe', '32');
DeleteFile('C:\Program Files (x86)\Application Assistance\app-helper.exe', '32');
DeleteFile('C:\Windows\system32\drivers\TAOAccelerator64.sys');
DeleteFile('C:\Windows\system32\drivers\TSSKX64.sys');
DeleteFile('C:\Windows\system32\drivers\TAOKernel64.sys');
DeleteFile('C:\Windows\system32\drivers\TFsFltX64.sys');
DeleteFile('C:\ProgramData\Browsers\browser0.bat', '');
DeleteFile('C:\ProgramData\Browsers\browser6.bat', '');
DeleteFile('C:\ProgramData\Browsers\browser4.bat', '');
DeleteFile('C:\Windows\SYSWOW64\drivers\TS888x64.sys');
DeleteFile('C:\Windows\system32\GroupPolicy\Machine\R','32');
DeleteFile('C:\Windows\system32\GroupPolicy\Machine\Registry.pol','32');
DeleteService('TSSKX64');
DeleteService('TFsFlt');
DeleteService('QQSysMonX64');
DeleteFileMask('C:\ProgramData\JWdsM', '*', true);
DeleteFileMask('C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}', '*', true);
DeleteFileMask('C:\Users\123456\AppData\Roaming\IObit', '*', true);
DeleteFileMask('C:\ProgramData\Tencent', '*', true);
DeleteFileMask('C:\ProgramData\IObit', '*', true);
DeleteFileMask('C:\Program Files (x86)\Tencent', '*', true);
DeleteFileMask('C:\Users\123456\AppData\Roaming\Tencent', '*', true);
DeleteFileMask('C:\Program Files\Common Files\Tencent', '*', true);
DeleteFileMask('C:\ProgramData\TXQMPC', '*', true);
DeleteFileMask('C:\Users\123456\AppData\Roaming\cpuminer', '*', true);
DeleteFileMask('C:\Users\123456\AppData\Roaming\istartsurf', '*', true);
DeleteFileMask('C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat', '*', true);
DeleteFileMask('C:\Users\123456\AppData\Roaming\AnyProtectEx', '*', true);
DeleteDirectory('C:\ProgramData\JWdsM', '');
DeleteDirectory('C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}', '');
DeleteDirectory('C:\Users\123456\AppData\Roaming\IObit', '');
DeleteDirectory('C:\ProgramData\Tencent', '');
DeleteDirectory('C:\ProgramData\IObit', '');
DeleteDirectory('C:\Program Files (x86)\Tencent', '');
DeleteDirectory('C:\Users\123456\AppData\Roaming\Tencent', '');
DeleteDirectory('C:\Program Files\Common Files\Tencent', '');
DeleteDirectory('C:\ProgramData\TXQMPC', '');
DeleteDirectory('C:\Users\123456\AppData\Roaming\cpuminer', '');
DeleteDirectory('C:\Users\123456\AppData\Roaming\istartsurf', '');
DeleteDirectory('C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat', '');
DeleteDirectory('C:\Users\123456\AppData\Roaming\AnyProtectEx', '');
DelBHO('{0633EE93-D776-472f-A0FF-E1416B8B2E3D}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'app-helper1');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'app-helper');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Eventlog\Application\', 'EventMessageFile');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','C');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteWizard('SCU',2,3,true);
RebootWindows(true);
end.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://spacesearch.ru/?ri=1&rsid=bfccde945acccdab15f8b52ff2b95cb0&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://spacesearch.ru/?ri=1&rsid=bfccde945acccdab15f8b52ff2b95cb0&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=97951667_hao_pg
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=97951667_hao_pg
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://spacesearch.ru/?ri=1&rsid=bfccde945acccdab15f8b52ff2b95cb0&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://spacesearch.ru/?ri=1&rsid=bfccde945acccdab15f8b52ff2b95cb0&q=
R3 - URLSearchHook: (no name) - {0633EE93-D776-472f-A0FF-E1416B8B2E3D} - (no file)
O2 - BHO: QPMIEHelper - {50F4150A-48B2-417A-BE4C-C83F580FB904} - C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll
O4 - HKLM\..\Run: [app-helper1] C:\Program Files (x86)\Application Assistance\app-helper1.exe
O4 - HKLM\..\Run: [app-helper] C:\Program Files (x86)\Application Assistance\app-helper.exe
O4 - HKCU\..\Run: [C] cmd /c copy/b/y C:\Windows\system32\GroupPolicy\Machine\R C:\Windows\system32\GroupPolicy\Machine\Registry.pol >nul
;uVS v3.86.5 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
regt 27
regt 28
regt 29
sreg
del %Sys32%\DRIVERS\TAOACCELERATOR64.SYS
del %Sys32%\DRIVERS\TAOKERNEL64.SYS
delref %Sys32%\DRIVERS\TAOACCELERATOR64.SYS
delref %Sys32%\DRIVERS\TAOKERNEL64.SYS
del %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\TS888X64.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\TS888X64.SYS
del %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\TSDEFENSEBT64.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\TSDEFENSEBT64.SYS
delref %Sys32%\DRIVERS\WWFD_VT_1_10_0_24.SYS
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\QMGCSHELLEXT64.DLL
delall %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\TENCENT\QQPHONEMANAGER\2.0.201.3198\NPQQPHONEMANAGEREXT.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\TAOFRAME.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.11.16588.235\QMCONTEXTSCAN.DLL
delall %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\TENCENT\QQDOWNLOAD\130\TENCENTDL.EXE
delall %SystemDrive%\USERS\123456\APPDATA\ROAMING\TENCENT\ANDROIDSERVER\1.0.0.485\ANDROIDSERVERUP.EXE
delall %SystemDrive%\USERS\123456\APPDATA\ROAMING\TENCENT\QQPHONEMANAGER\COMPONENTS\UPDATE\UPDATE.EXE
deldirex %SystemDrive%\USERS\123456\APPDATA\ROAMING\TENCENT
deldirex %SystemDrive%\PROGRAM FILES (X86)\TENCENT
delref %SystemDrive%\USERS\123456\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PANGPKJIDGGJMENGCAPMLLOJLOAHMGEK\0.0.0.1_0\LIKECOUPON
delref HTTP://SEARCLH-NAITIY.RU
deldir %SystemDrive%\USERS\123456\APPDATA\LOCAL\TEMP\6422911
zoo %SystemDrive%\USERS\123456\APPDATA\LOCAL\TEMP\11644795\LIKECOUPON_SETUP (3).EXE
del %SystemDrive%\USERS\123456\APPDATA\LOCAL\TEMP\11644795\LIKECOUPON_SETUP (3).EXE
del %SystemDrive%\PROGRAMDATA\BROWSERS\BROWSER0.BAT
del %SystemDrive%\PROGRAMDATA\BROWSERS\BROWSER4.BAT
del %SystemDrive%\PROGRAMDATA\BROWSERS\BROWSER6.BAT
zoo %SystemDrive%\USERS\123456\APPDATA\LOCAL\TEMP\10985468\SCEARCHY-NAYTY.RU_RU.EXE
del %SystemDrive%\USERS\123456\APPDATA\LOCAL\TEMP\10985468\SCEARCHY-NAYTY.RU_RU.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\UNINSTALLMENURIGHT64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\UNINSTALLEXPLORER64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\IOBITUNINSTALER.EXE
delref %SystemDrive%\PROGRAM FILES\CONTENT DEFENDER\CONTENTDEFENDER.EXE
deltmp
czoo
areg
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?
We use cookies and similar technologies for the following purposes:
Do you accept cookies and these technologies?