begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files (x86)\izACJBnbNDehC\erqDhmE.dll', '');
QuarantineFile('C:\Program Files (x86)\OawdtYVZRIWObRpdfxR\bxASUyK.dll', '');
QuarantineFile('C:\Program Files (x86)\UqTwBgDtGSzU2\MqVlsudCRcbkC.dll', '');
QuarantineFile('C:\Program Files (x86)\YUZBIsHfU\qluCck.dll', '');
QuarantineFile('C:\ProgramData\sgfZORgZcDZcHzVB\SXvkwWU.wsf^', '');
DeleteFile('C:\Program Files (x86)\izACJBnbNDehC\erqDhmE.dll', '64');
DeleteFile('C:\Program Files (x86)\OawdtYVZRIWObRpdfxR\bxASUyK.dll', '64');
DeleteFile('C:\Program Files (x86)\UqTwBgDtGSzU2\MqVlsudCRcbkC.dll', '64');
DeleteFile('C:\Program Files (x86)\YUZBIsHfU\qluCck.dll', '64');
DeleteFile('C:\ProgramData\sgfZORgZcDZcHzVB\SXvkwWU.wsf^', '64');
DeleteSchedulerTask('CmatoOjeOVwOtN');
DeleteSchedulerTask('dzCSQuGXJdROA2');
DeleteSchedulerTask('JqpzotDuOzihqwGNsSc2');
DeleteSchedulerTask('JxDTAeSDsEmENoF2');
DeleteSchedulerTask('QacAtYLWpczjxzoKE2');
DeleteFileMask('C:\Program Files (x86)\izACJBnbNDehC', '*.*', true);
DeleteFileMask('C:\Program Files (x86)\OawdtYVZRIWObRpdfxR', '*.*', true);
DeleteFileMask('C:\Program Files (x86)\UqTwBgDtGSzU2', '*.*', true);
DeleteFileMask('C:\Program Files (x86)\YUZBIsHfU', '*.*', true);
DeleteFileMask('C:\ProgramData\sgfZORgZcDZcHzVB', '*.*', true);
DeleteDirectory('C:\Program Files (x86)\izACJBnbNDehC');
DeleteDirectory('C:\Program Files (x86)\OawdtYVZRIWObRpdfxR');
DeleteDirectory('C:\Program Files (x86)\UqTwBgDtGSzU2');
DeleteDirectory('C:\Program Files (x86)\YUZBIsHfU');
DeleteDirectory('C:\ProgramData\sgfZORgZcDZcHzVB');
BC_ImportALL;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.R3 - HKCU\..\URLSearchHooks: (no name) - {C9423817-5DA7-494E-87E4-111F1B49A1FD} - (no file)
O2 - HKLM\..\BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - HKLM\..\BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{993F5746-4C15-42BC-99C1-064A1764271B}: [SuggestionsURL,TopResultURL] = https://defaultsearch.co?q={searchTerms} - DefaultSearchYahoo
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{993F5746-4C15-42BC-99C1-064A1764271B}: [URL] = https://securesearch.org?q={searchTerms} - DefaultSearchYahoo
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\44ddd402-8e14-11ea-b749-00d8619d66ec: [SuggestionsURL,SuggestionsURLFallback] = https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms} - CDNSearch
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\44ddd402-8e14-11ea-b749-00d8619d66ec: [URL] = http://search-cdn.net/fip/?q={searchTerms} - CDNSearch
O4 - HKCU\..\Run: [RuntimeBroker] = C:\ProgramData\RuntimeBroker\RuntimeBroker.exe (file missing)
O4 - HKCU\..\StartupApproved\Run: [Gaijin.Net Updater] = C:\Users\Semen\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe (file missing) (2021/05/04)
O4 - HKCU\..\StartupApproved\Run: [Spotify] = C:\Users\Semen\AppData\Roaming\Spotify\Spotify.exe --autostart --minimized (file missing) (2022/01/08)
O7 - Policy: HKLM\Software\Microsoft\Windows Defender: [DisableAntiSpyware] = 1
O7 - Policy: HKLM\Software\Microsoft\Windows Defender: [DisableAntiVirus] = 1
O7 - Policy: HKLM\Software\Microsoft\Windows Defender\Features: [TamperProtection] = 4
O7 - Policy: HKLM\Software\Microsoft\Windows Defender\Real-Time Protection: [DisableRealtimeMonitoring] = 1
O22 - Tasks: (disabled) ElementsBrowser Update - C:\Users\Semen\AppData\Local\Elements Browser\Application\elementsbrowserupdate.exe (file missing)
O22 - Tasks: (disabled) Process Lasso Core Engine Only - D:\Process Lasso\processgovernor.exe (file missing)
O22 - Tasks: (disabled) Process Lasso Management Console (GUI) - D:\Process Lasso\processlasso.exe (file missing)
O22 - Tasks: (disabled) YSLogonUpdate - C:\Program Files (x86)\YandexSovetnik\checkupd.exe (file missing)
O22 - Tasks: (disabled) YSPeriodicUpdate - C:\Program Files (x86)\YandexSovetnik\checkupd.exe (file missing)
