1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
| begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
QuarantineFileF('c:\users\1\appdata\local\smartweb', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 ,0);
QuarantineFileF('c:\program files (x86)\sfk', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 ,0);
QuarantineFileF('C:\Program Files\SpaceSoundPro', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 ,0);
QuarantineFileF('C:\ProgramData\TimeTasks', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 ,0);
QuarantineFileF('C:\Program Files (x86)\Zaxar', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js', true, '', 0 ,0);
QuarantineFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\hnsd36a4.tmp', '');
QuarantineFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\jnsje8a.tmp', '');
QuarantineFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\knsjf144.tmpfs', '');
QuarantineFile('c:\users\1\appdata\local\temp\nsf2bf9.tmp', '');
QuarantineFile('c:\users\1\appdata\local\a07c9f9b-1450203760-de11-ac7d-ba4f744d9882\qnsrf0b7.tmp', '');
QuarantineFile('c:\users\1\appdata\local\smartweb\smartwebapp.exe', '');
QuarantineFile('c:\users\1\appdata\local\smartweb\smartwebhelper.exe', '');
QuarantineFile('c:\program files (x86)\sfk\ssfk.exe', '');
QuarantineFile('c:\users\1\appdata\local\gmsd_ru_005010176\upgmsd_ru_005010176.exe', '');
QuarantineFile('C:\Users\1\AppData\Local\SmartWeb\swhk.dll', '');
QuarantineFile('C:\Users\1\AppData\Roaming\daemon2.exe', '');
QuarantineFile('C:\Program Files (x86)\gmsd_ru_005010176\gmsd_ru_005010176.exe', '');
QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe', '');
QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe', '');
QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe', '');
QuarantineFile('C:\ProgramData\xDWLLfMGsbCN\ycAAlveMJGtRDcY0.bat', '');
QuarantineFile('C:\ProgramData\gtullAjG\kvWSEyDufi5.bat', '');
QuarantineFile('C:\Users\1\appdata\local\smartweb\__u.exe', '');
ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true);
DeleteFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\hnsd36a4.tmp', '32');
DeleteFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\jnsje8a.tmp', '32');
DeleteFile('c:\program files (x86)\a07c9f9b-1450166014-de11-ac7d-ba4f744d9882\knsjf144.tmpfs', '32');
DeleteFile('c:\users\1\appdata\local\temp\nsf2bf9.tmp', '32');
DeleteFile('c:\users\1\appdata\local\a07c9f9b-1450203760-de11-ac7d-ba4f744d9882\qnsrf0b7.tmp', '32');
DeleteFile('c:\users\1\appdata\local\smartweb\smartwebapp.exe', '32');
DeleteFile('c:\users\1\appdata\local\smartweb\smartwebhelper.exe', '32');
DeleteFile('c:\program files (x86)\sfk\ssfk.exe', '32');
DeleteFile('c:\users\1\appdata\local\gmsd_ru_005010176\upgmsd_ru_005010176.exe', '32');
DeleteFile('C:\Users\1\AppData\Local\SmartWeb\swhk.dll', '32');
DeleteFile('C:\Users\1\AppData\Roaming\daemon2.exe', '32');
DeleteFile('C:\Program Files (x86)\gmsd_ru_005010176\gmsd_ru_005010176.exe', '32');
DeleteFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '32');
DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe', '32');
DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe', '32');
DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe', '32');
DeleteFile('C:\ProgramData\xDWLLfMGsbCN\ycAAlveMJGtRDcY0.bat', '32');
DeleteFile('C:\ProgramData\gtullAjG\kvWSEyDufi5.bat', '32');
DeleteFile('C:\Users\1\appdata\local\smartweb\__u.exe', '32');
DeleteFileMask('c:\users\1\appdata\local\smartweb', '*', true);
DeleteFileMask('c:\program files (x86)\sfk', '*', true);
DeleteFileMask('C:\Program Files\SpaceSoundPro', '*', true);
DeleteFileMask('C:\ProgramData\TimeTasks', '*', true);
DeleteFileMask('C:\Program Files (x86)\Zaxar', '*', true);
DeleteDirectory('c:\users\1\appdata\local\smartweb');
DeleteDirectory('c:\program files (x86)\sfk');
DeleteDirectory('C:\Program Files\SpaceSoundPro');
DeleteDirectory('C:\ProgramData\TimeTasks');
DeleteDirectory('C:\Program Files (x86)\Zaxar');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SmartWeb');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','upgmsd_ru_005010176.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Daemon','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010176','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SmartWeb','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpaceSoundPro','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Timestasks','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarGameBrowser','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarLoader','command');
DeleteService('ginoquci');
DeleteService('hidekoqe');
DeleteService('rizyqibe');
DeleteService('SSFK');
DeleteService('wucihivu');
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end. |
(
Сообщение от shestale
