begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\users\zlo\appdata\local\temp\wizz\ioproduct.exe');
TerminateProcessByName('c:\users\zlo\appdata\local\temp\wizz\ioprotect.exe');
TerminateProcessByName('c:\users\zlo\appdata\local\gmsd_ru_005010076\upgmsd_ru_005010076.exe');
TerminateProcessByName('C:\ProgramData\3WdsManPro3\WdsManPro.exe');
QuarantineFile('C:\Program Files (x86)\baidu\pps.exe','');
QuarantineFile('C:\ProgramData\3WdsManPro3\WdsManPro.exe','');
QuarantineFile('c:\users\zlo\appdata\local\temp\wizz\ioproduct.exe', '');
QuarantineFile('c:\users\zlo\appdata\local\temp\wizz\ioprotect.exe', '');
QuarantineFile('c:\users\zlo\appdata\local\gmsd_ru_005010076\upgmsd_ru_005010076.exe', '');
QuarantineFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\knsu8867.tmpfs', '');
QuarantineFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\jnsvAF20.tmp', '');
QuarantineFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\hnsoC50B.tmp', '');
QuarantineFile('C:\Program Files (x86)\Google\chrome.bat', '');
QuarantineFile('C:\Program Files (x86)\gmsd_ru_005010076\gmsd_ru_005010076.exe', '');
QuarantineFile('C:\Users\zlo\AppData\Local\Temp\WIZZ\ioproduct_service.bat', '');
QuarantineFile('C:\iexplore.bat', '');
QuarantineFile('C:\Users\zlo\AppData\Roaming\SLAjTKTYisEsq.exe', '');
QuarantineFile('C:\Users\zlo\AppData\Roaming\W9eyE7FFHspgGhDA5teqx.exe', '');
QuarantineFile('C:\Users\zlo\AppData\Roaming\WindowsUpdater\Updater.exe', '');
ExecuteFile('schtasks.exe', '/delete /TN "SLAjTKTYisEsq.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "W9eyE7FFHspgGhDA5teqx.job" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SLAjTKTYisEsq" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "W9eyE7FFHspgGhDA5teqx" /F', 0, 15000, true);
DeleteFile('C:\ProgramData\3WdsManPro3\WdsManPro.exe','32');
DeleteFile('C:\Program Files (x86)\baidu\pps.exe','32');
DeleteFile('c:\users\zlo\appdata\local\temp\wizz\ioproduct.exe', '32');
DeleteFile('c:\users\zlo\appdata\local\temp\wizz\ioprotect.exe', '32');
DeleteFile('c:\users\zlo\appdata\local\gmsd_ru_005010076\upgmsd_ru_005010076.exe', '32');
DeleteFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\knsu8867.tmpfs', '32');
DeleteFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\jnsvAF20.tmp', '32');
DeleteFile('C:\Program Files (x86)\00000000-1440972811-0000-0000-001A4D4BA126\hnsoC50B.tmp', '32');
DeleteFile('C:\Program Files (x86)\Google\chrome.bat', '32');
DeleteFile('C:\Program Files (x86)\gmsd_ru_005010076\gmsd_ru_005010076.exe', '32');
DeleteFile('C:\Users\zlo\AppData\Local\Temp\WIZZ\ioproduct_service.bat', '32');
DeleteFile('C:\iexplore.bat', '32');
DeleteFile('C:\Users\zlo\AppData\Roaming\SLAjTKTYisEsq.exe', '32');
DeleteFile('C:\Users\zlo\AppData\Roaming\W9eyE7FFHspgGhDA5teqx.exe', '32');
DeleteFile('C:\Users\zlo\AppData\Roaming\WindowsUpdater\Updater.exe', '32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','apphide');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_ru_005010076');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','IOPROTECT');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','upgmsd_ru_005010076.exe');
DeleteService('figiwoce');
DeleteService('jimocoso');
DeleteService('totyseku');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.
(
