Лечение вируса

begin
 ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 ClearQuarantineEx(true);
 TerminateProcessByName('c:\temp\is-nrp6q.tmp\a4sjrk3onzo.tmp');
 TerminateProcessByName('c:\users\Администратор\appdata\roaming\h1sfhlh3nhs\a4sjrk3onzo.exe');
 StopService('Windows');
 QuarantineFile('C:\ProgramData\tiser\run.exe', '');
 QuarantineFile('C:\ProgramData\Voyasollam\Holdhome.dll', '');
 QuarantineFile('C:\ProgramData\Voyasollam\TrisQuadstrong.dll', '');
 QuarantineFile('c:\temp\is-nrp6q.tmp\a4sjrk3onzo.tmp', '');
 QuarantineFile('C:\TEMP\is-RRGO0.tmp\idp.dll', '');
 QuarantineFile('c:\users\Администратор\appdata\roaming\h1sfhlh3nhs\a4sjrk3onzo.exe', '');
 QuarantineFile('C:\Users\Администратор\appdata\roaming\windowsapps\cpu\intel.exe', '');
 QuarantineFile('C:\Users\Администратор\appdata\roaming\windowsapps\cpu1\intel1.exe', '');
 QuarantineFile('C:\Users\Администратор\appdata\roaming\windowsapps\taskhost.exe', '');
 QuarantineFile('C:\Users\Администратор\appdata\roaming\windowsdefender\msascuil.exe', '');
 QuarantineFile('C:\Windows\Temp\svchost.exe', '');
 DeleteFile('C:\ProgramData\tiser\run.exe', '32');
 DeleteFile('C:\ProgramData\Voyasollam\Holdhome.dll', '32');
 DeleteFile('C:\ProgramData\Voyasollam\TrisQuadstrong.dll', '32');
 DeleteFile('c:\temp\is-nrp6q.tmp\a4sjrk3onzo.tmp', '32');
 DeleteFile('C:\TEMP\is-RRGO0.tmp\idp.dll', '32');
 DeleteFile('c:\users\Администратор\appdata\roaming\h1sfhlh3nhs\a4sjrk3onzo.exe', '32');
 DeleteFile('C:\Users\Администратор\appdata\roaming\windowsapps\cpu\intel.exe', '32');
 DeleteFile('C:\Users\Администратор\appdata\roaming\windowsapps\cpu1\intel1.exe', '32');
 DeleteFile('C:\Users\Администратор\appdata\roaming\windowsapps\taskhost.exe', '32');
 DeleteFile('C:\Users\Администратор\appdata\roaming\windowsdefender\msascuil.exe', '32');
 DeleteFile('C:\Windows\Temp\svchost.exe', '32');
 DeleteService('tiser');
 DeleteService('Windows');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', '3139676');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
ExecuteSysClean;
 ExecuteRepair(4);
 ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.

O7 - Policy: [Untrusted Certificate] Fix all items from the log
O20 - AppInit_DLLs: C:\ProgramData\Voyasollam\TrisQuadstrong.dll
O20-32 - AppInit_DLLs: C:\ProgramData\Voyasollam\Holdhome.dll