begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
StopService('0325401462528067mcinstcleanup');
StopService('GENERICDRV');
QuarantineFileF('c:\programdata\microsoft\macromed\flash player\df69c016-afd3-4665-9422-5b5993e7ab37', '*', true, '', 0 ,0);
QuarantineFileF('c:\programdata\krb updater utility', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
QuarantineFileF('c:\users\наталья\appdata\locallow\searchgo', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
QuarantineFileF('c:\users\наталья\appdata\local\fupdate', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
QuarantineFileF('c:\program files (x86)\kinoroom browser', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
QuarantineFileF('c:\users\наталья\appdata\local\searchgo', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
QuarantineFile('C:\Users\98AF~1\AppData\Local\Temp\032540~1.EXE', '');
QuarantineFile('C:\Users\ADMINI~1\AppData\Local\Temp\pft2E9E.tmp\amifldrv64.sys', '');
QuarantineFile('C:\ProgramData\Microsoft\Macromed\Flash Player\DF69C016-AFD3-4665-9422-5B5993E7AB37\F415021B-83D5-4C9D-BE42-CEDDB15788E2.exe', '');
QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe', '');
QuarantineFile('C:\Users\Наталья\AppData\Local\Kometa', '');
QuarantineFile('C:\Users\Наталья\AppData\LocalLow\SearchGo\searchgo.dll', '');
QuarantineFile('C:\Users\Наталья\AppData\Local\fupdate\fupdate.exe', '');
QuarantineFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe', '');
QuarantineFile('C:\Users\Наталья\AppData\Local\SearchGo\searchgo.exe', '');
ExecuteFile('schtasks.exe', '/delete /TN "fupdate" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KRB Updater Utility Service" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "KRBLNKRUN" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "ADF69C016-AFD3-4665-9422-5B5993E7AB37" /F', 0, 15000, true);
ExecuteFile('schtasks.exe', '/delete /TN "SearchGo Task" /F', 0, 15000, true);
DeleteFile('C:\Users\98AF~1\AppData\Local\Temp\032540~1.EXE', '32');
DeleteFile('C:\Users\ADMINI~1\AppData\Local\Temp\pft2E9E.tmp\amifldrv64.sys', '32');
DeleteFile('C:\ProgramData\Microsoft\Macromed\Flash Player\DF69C016-AFD3-4665-9422-5B5993E7AB37\F415021B-83D5-4C9D-BE42-CEDDB15788E2.exe', '32');
DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe', '32');
DeleteFile('C:\Users\Наталья\AppData\Local\Kometa', '32');
DeleteFile('C:\Users\Наталья\AppData\LocalLow\SearchGo\searchgo.dll', '32');
DeleteFile('C:\Users\Наталья\AppData\Local\fupdate\fupdate.exe', '32');
DeleteFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe', '32');
DeleteFile('C:\Users\Наталья\AppData\Local\SearchGo\searchgo.exe', '32');
DeleteFileMask('c:\programdata\krb updater utility', '*', true);
DeleteFileMask('c:\users\наталья\appdata\locallow\searchgo', '*', true);
DeleteFileMask('c:\users\наталья\appdata\local\fupdate', '*', true);
DeleteFileMask('c:\program files (x86)\kinoroom browser', '*', true);
DeleteFileMask('c:\users\наталья\appdata\local\searchgo', '*', true);
DeleteDirectory('c:\programdata\krb updater utility');
DeleteDirectory('c:\users\наталья\appdata\locallow\searchgo');
DeleteDirectory('c:\users\наталья\appdata\local\fupdate');
DeleteDirectory('c:\program files (x86)\kinoroom browser');
DeleteDirectory('c:\users\наталья\appdata\local\searchgo');
DelBHO('{598AEFC6-DD3C-4A63-9AC3-53FCF6155931}');
DelBHO('{2BC46CFA-4B00-4193-A7BD-6AD1D0BCB5BC}');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','DF69C016-AFD3-4665-9422-5B5993E7AB37');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','KRB Updater Utility');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
DeleteService('0325401462528067mcinstcleanup');
DeleteService('GENERICDRV');
ExecuteSysClean;
ExecuteRepair(1);
ExecuteWizard('SCU', 2, 3, true);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.