begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('schtasks.exe', '/delete /TN "SearchGo Task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "Trusted Line Helper" /F', 0, 15000, true);
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\program files\screenup\future_helper.exe');
QuarantineFileF('c:\program files\screenup', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\users\альберт\appdata\locallow\searchgo', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\users\альберт\appdata\local\searchgo', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFile('c:\program files\screenup\future_helper.exe', '');
QuarantineFile('C:\Program Files\ScreenUp\nfapi.dll', '');
QuarantineFile('C:\Program Files\Youtube AdBlock\IEEF\OfDbbC0aQR.exe', '');
QuarantineFile('C:\Program Files\ScreenUp\ProtocolFilters.dll', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\DateOption\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\FilterOptions\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\FileSystemOptions\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\TestMenu\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\ImmediateHelp\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\LastNews\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\ValidateLife\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\rightchose\regCheck.vbs', '');
QuarantineFile('C:\Users\Альберт\AppData\LocalLow\SearchGo\searchgo.dll', '');
QuarantineFile('C:\Users\Альберт\AppData\Local\SearchGo\searchgo.exe', '');
DeleteFile('c:\program files\screenup\future_helper.exe', '32');
DeleteFile('C:\Program Files\ScreenUp\nfapi.dll', '32');
DeleteFile('C:\Program Files\ScreenUp\ProtocolFilters.dll', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\DateOption\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\FilterOptions\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\FileSystemOptions\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\TestMenu\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\ImmediateHelp\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\LastNews\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\ValidateLife\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\rightchose\regCheck.vbs', '32');
DeleteFile('C:\Users\Альберт\AppData\LocalLow\SearchGo\searchgo.dll', '32');
DeleteFile('C:\Users\Альберт\AppData\Local\SearchGo\searchgo.exe', '32');
DeleteFileMask('c:\program files\screenup', '*', true);
DeleteFileMask('c:\users\альберт\appdata\locallow\searchgo', '*', true);
DeleteFileMask('c:\users\альберт\appdata\local\searchgo', '*', true);
DeleteDirectory('c:\program files\screenup');
DeleteDirectory('c:\users\альберт\appdata\locallow\searchgo');
DeleteDirectory('c:\users\альберт\appdata\local\searchgo');
DelBHO('{598AEFC6-DD3C-4A63-9AC3-53FCF6155931}');
DelBHO('{2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'DateOption');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'FilterOptions');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'stzspsakli');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'FileSystemOptions');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'TestMenu');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'ImmediateHelp');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'LastNews');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run', 'ValidateLife');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.