begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
SetServiceStart('Microsoft Framework', 4);
QuarantineFile('C:\Program Files\rdp wrapper\rdpwrap.dll', '');
QuarantineFile('C:\Programdata\ReaItekHD\taskhost.exe', '');
QuarantineFile('C:\ProgramData\ReaItekHD\taskhostw.exe', '');
QuarantineFile('C:\ProgramData\Windows Tasks Service\winserv.exe', '');
QuarantineFile('C:\ProgramData\windowstask\amd.exe', '');
QuarantineFile('C:\ProgramData\windowstask\appmodule.exe', '');
QuarantineFile('C:\ProgramData\windowstask\audiodg.exe', '');
QuarantineFile('C:\ProgramData\windowstask\microsofthost.exe', '');
QuarantineFile('C:\Windows\System32\unsecapp.exe', '');
DeleteFile('C:\Program Files\rdp wrapper\rdpwrap.dll', '32');
DeleteFile('C:\Programdata\ReaItekHD\taskhost.exe', '64');
DeleteFile('C:\Programdata\ReaItekHD\taskhostw.exe', '64');
DeleteFile('C:\ProgramData\Windows Tasks Service\winserv.exe', '64');
DeleteFile('C:\ProgramData\windowstask\amd.exe', '32');
DeleteFile('C:\ProgramData\windowstask\appmodule.exe', '32');
DeleteFile('C:\ProgramData\windowstask\audiodg.exe', '32');
DeleteFile('C:\ProgramData\windowstask\microsofthost.exe', '32');
DeleteFile('C:\Windows\System32\unsecapp.exe', '64');
DeleteService('Microsoft Framework');
DeleteSchedulerTask('Microsoft\Windows\WindowsBackup\OnlogonCheck');
DeleteSchedulerTask('Microsoft\Windows\WindowsBackup\RealtekCheck');
DeleteSchedulerTask('Microsoft\Windows\WindowsBackup\TaskCheck');
DeleteSchedulerTask('Microsoft\Windows\WindowsBackup\WinlogonCheck');
DeleteSchedulerTask('Microsoft\Windows\Wininet\winser');
DeleteSchedulerTask('Microsoft\Windows\Wininet\winsers');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(9);
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.
