begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantineEx(true);
TerminateProcessByName('c:\program files\izhmcfrdqie\yobdrpkljl.exe');
TerminateProcessByName('c:\program files\zaxar\zaxargamebrowser.exe');
TerminateProcessByName('c:\program files\zaxar\zaxarloader.exe');
TerminateProcessByName('c:\users\ПОльзователь\appdata\roaming\schedtasksetup\sched.exe');
QuarantineFile('C:\Program Files\fnPaJQZyeiYpfygOWnR\YNzAeQT.dll', '');
QuarantineFile('C:\Program Files\iZhmcFrdQIE\klNcNoGo.dll', '');
QuarantineFile('c:\program files\izhmcfrdqie\yobdrpkljl.exe', '');
QuarantineFile('C:\Program Files\lFfTovwAFQMrC\JwBLvFw.dll', '');
QuarantineFile('C:\Program Files\nPcIvKnkFinU2\IotgyReEGaFcs.dll', '');
QuarantineFile('C:\Program Files\priPbkELU\ogREac.dll', '');
QuarantineFile('C:\Program Files\Zaxar\libjsons.dll', '');
QuarantineFile('C:\Program Files\Zaxar\QtWebKit4.dll', '');
QuarantineFile('c:\program files\zaxar\zaxargamebrowser.exe', '');
QuarantineFile('c:\program files\zaxar\zaxarloader.exe', '');
QuarantineFile('C:\ProgramData\LpgGfxGjetDHvVVB\tOBvxPc.wsf', '');
QuarantineFile('C:\Users\ПОльзователь\AppData\Local\Good Chrome\Application\goodchromeupdate.exe', '');
QuarantineFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk', '');
QuarantineFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Вконтакте в браузере Good Chrome.lnk', '');
QuarantineFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Одноклассники в браузере Good Chrome.lnk', '');
QuarantineFile('c:\users\ПОльзователь\appdata\roaming\schedtasksetup\sched.exe', '');
QuarantineFileF('c:\program files\zaxar', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
DeleteSchedulerTask('Good Chrome Update');
DeleteSchedulerTask('ImuiESGRLUmPUprjHGW2');
DeleteSchedulerTask('kdKZUyTimeniOb');
DeleteSchedulerTask('mjIRcknPgtYnU2');
DeleteSchedulerTask('UjyqmGPXSLNtWvH2');
DeleteSchedulerTask('XhTxmRHsepkzJLwrJ2');
DeleteFile('C:\Program Files\fnPaJQZyeiYpfygOWnR\YNzAeQT.dll', '32');
DeleteFile('C:\Program Files\iZhmcFrdQIE\klNcNoGo.dll', '32');
DeleteFile('c:\program files\izhmcfrdqie\yobdrpkljl.exe', '32');
DeleteFile('C:\Program Files\lFfTovwAFQMrC\JwBLvFw.dll', '32');
DeleteFile('C:\Program Files\nPcIvKnkFinU2\IotgyReEGaFcs.dll', '32');
DeleteFile('C:\Program Files\priPbkELU\ogREac.dll', '32');
DeleteFile('C:\Program Files\Zaxar\libjsons.dll', '');
DeleteFile('C:\Program Files\Zaxar\QtWebKit4.dll', '');
DeleteFile('c:\program files\zaxar\zaxargamebrowser.exe', '');
DeleteFile('c:\program files\zaxar\zaxarloader.exe', '');
DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe', '32');
DeleteFile('C:\ProgramData\LpgGfxGjetDHvVVB\tOBvxPc.wsf', '32');
DeleteFile('C:\Users\ПОльзователь\AppData\Local\Good Chrome\Application\goodchromeupdate.exe', '32');
DeleteFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk');
DeleteFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Вконтакте в браузере Good Chrome.lnk');
DeleteFile('C:\Users\ПОльзователь\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Одноклассники в браузере Good Chrome.lnk');
DeleteFile('c:\users\ПОльзователь\appdata\roaming\schedtasksetup\sched.exe', '32');
DeleteFileMask('c:\program files\zaxar', '*', true);
DeleteDirectory('c:\program files\zaxar');
DelBHO('{1CCFB9EB-3420-47CA-9624-3BC20B074C7F}');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SchedTaskSetup', 'x32');
BC_ImportALL;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_Activate;
RebootWindows(true);
end.