begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\programdata\gwdsmanprog\wdsmanpro.exe');
TerminateProcessByName('c:\programdata\zitenop\zitenop.exe');
TerminateProcessByName('c:\program files\concom\packages\8f9a1d80-41e2-4b32-910a-329f98fcd97c\stanron.exe');
TerminateProcessByName('c:\programdata\exttag\exttag.exe');
TerminateProcessByName('c:\program files\concom\concom.exe');
TerminateProcessByName('c:\users\dexp\appdata\local\microsoft\macromed\flash player\updater startup utility\7ec78ed7-170f-4193-b7ed-51d8e692d53b.exe');
StopService('Zitenop');
StopService('WdsManPro');
StopService('ExtTag');
StopService('Concom');
StopService('OATool');
QuarantineFile('C:\Program Files\Sonic Train\Extensions\0c3ddfb7-4cdb-495b-b3e9-d59725b43dfc.dll','');
QuarantineFile('C:\Users\dexp\AppData\Local\Microsoft\Extensions\extsetup.exe','');
QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe','');
QuarantineFile('C:\Program Files\Kinoroom Browser\krbrowser.exe','');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe','');
QuarantineFile('C:\Program Files\Zaxar\ZaxarLoader.exe','');
QuarantineFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','');
QuarantineFile('c:\programdata\gwdsmanprog\wdsmanpro.exe','');
QuarantineFile('c:\programdata\zitenop\zitenop.exe','');
QuarantineFile('c:\program files\concom\packages\8f9a1d80-41e2-4b32-910a-329f98fcd97c\stanron.exe','');
QuarantineFile('c:\programdata\exttag\exttag.exe','');
QuarantineFile('c:\program files\concom\concom.exe','');
QuarantineFile('c:\users\dexp\appdata\local\microsoft\macromed\flash player\updater startup utility\7ec78ed7-170f-4193-b7ed-51d8e692d53b.exe','');
QuarantineFile('C:\ProgramData\BymUaPBvqYlU\FhzyDSLmHLll5.bat','');
QuarantineFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\hnsjA66F.tmp', '');
QuarantineFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\knsk3AD7.tmp', '');
QuarantineFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\jnsj8E8F.tmp', '');
QuarantineFile('C:\Users\tester\AppData\Local\Temp\OATool.sys', '');
QuarantineFile('C:\Users\dexp\AppData\Local\U\1.bat', '');
QuarantineFile('C:\Program Files\Concom\packages\8f9a1d80-41e2-4b32-910a-329f98fcd97c\temp\run.exe', '');
QuarantineFile('C:\Users\dexp\AppData\Local\SystemDir\nethost.exe', '');
QuarantineFile('C:\Users\dexp\AppData\Local\Temp\Updater.exe', '');
QuarantineFile('c:\task.vbs', '');
DeleteFile('c:\users\dexp\appdata\local\microsoft\macromed\flash player\updater startup utility\7ec78ed7-170f-4193-b7ed-51d8e692d53b.exe','32');
DeleteFile('c:\program files\concom\concom.exe','32');
DeleteFile('c:\programdata\exttag\exttag.exe','32');
DeleteFile('c:\program files\concom\packages\8f9a1d80-41e2-4b32-910a-329f98fcd97c\stanron.exe','32');
DeleteFile('c:\programdata\zitenop\zitenop.exe','32');
DeleteFile('c:\programdata\gwdsmanprog\wdsmanpro.exe','32');
DeleteFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','32');
DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe','32');
DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe','32');
DeleteFile('C:\Program Files\Kinoroom Browser\krbrowser.exe','32');
DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater-utility.exe','32');
DeleteFile('C:\Users\dexp\AppData\Local\Microsoft\Extensions\extsetup.exe','32');
DeleteFile('C:\Program Files\Sonic Train\Extensions\0c3ddfb7-4cdb-495b-b3e9-d59725b43dfc.dll','32');
DeleteFile('C:\ProgramData\BymUaPBvqYlU\FhzyDSLmHLll5.bat','32');
DeleteFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\hnsjA66F.tmp', '32');
DeleteFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\knsk3AD7.tmp', '32');
DeleteFile('C:\Program Files\12345678-1444567975-5678-90AB-CDDEEFAABBCC\jnsj8E8F.tmp', '32');
DeleteFile('C:\Users\tester\AppData\Local\Temp\OATool.sys', '32');
DeleteFile('C:\Users\dexp\AppData\Local\U\1.bat', '32');
DeleteFile('C:\Program Files\Concom\packages\8f9a1d80-41e2-4b32-910a-329f98fcd97c\temp\run.exe', '32');
DeleteFile('C:\Users\dexp\AppData\Local\SystemDir\nethost.exe', '32');
DeleteFile('C:\Users\dexp\AppData\Local\Temp\Updater.exe', '32');
DeleteFile('c:\task.vbs', '32');
ExecuteFile('schtasks.exe', '/delete /TN "Install" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "extsetup" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SafeBrowser" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "nethost task" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "runTask" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "updateTask" /F', 0, 15000, true);
DeleteService('Zitenop');
DeleteService('WdsManPro');
DeleteService('ExtTag');
DeleteService('Concom');
DeleteService('gyvixodu');
DeleteService('hevejezu');
DeleteService('zehygiqo');
DeleteService('OATool');
DeleteFileMask('C:\Users\dexp\AppData\Local\SystemDir', '*', true);
DeleteDirectory('C:\Users\dexp\AppData\Local\SystemDir');
DelBHO('{0c3ddfb7-4cdb-495b-b3e9-d59725b43dfc}');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarGameBrowser');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarLoader');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Timestasks');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Kinoroom Browser');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','KRB Updater Utility');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','SafeBrowser');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(3);
ExecuteRepair(4);
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
(
