Подозрительные процессы в диспетчере.

procedure ClearSystemRestore;
var
  Script: TStringList;
  winName: string;
begin
  if IsNT then
    begin
      winName := UpperCase(RegKeyStrParamRead('HKLM', 'Software\Microsoft\Windows NT\CurrentVersion', 'ProductName'));
      case (Pos('WINDOWS VISTA', winName) > 0) or (Pos('WINDOWS 7', winName) > 0) of
        True:
          begin
            ExecuteFile('wmic', 'shadowcopy delete', 0, 60000, False);
            ExecuteFile('wmic', '/Namespace:\\root\default Path SystemRestore Call CreateRestorePoint "PointSafeZone", 100, 12', 0, 60000, False);
          end;
        False:
          begin
            Script := TStringList.Create;
            Script.Add(
              'Set objSR = GetObject("winmgmts:\\.\root\default:SystemRestore")' + #13#10 +
              'dResult = objSR.Disable("")' + #13#10 +
              'WScript.Sleep 5000' + #13#10 +
              'eResult = objSR.Enable("")' + #13#10 +
              'WScript.Sleep 5000' + #13#10 +
              'Set wshEnv = CreateObject("WScript.Shell").Environment("Process")' + #13#10 +
              'sysDrive = wshEnv("SYSTEMDRIVE")' + #13#10 +
              'Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")' + #13#10 +
              'For Each objDisk In objWMI.ExecQuery("Select DeviceID From Win32_LogicalDisk Where DriveType = 3")' + #13#10 +
              'If objDisk.DeviceID <> sysDrive Then objSR.Disable objDisk.DeviceID & "\"' + #13#10 +
              'Next');
            Script.SaveToFile('ClearSR.vbs');
            ExecuteFile('wscript.exe', 'ClearSR.vbs', 0, 60000, True);
            DeleteFile('ClearSR.vbs');
            ClearLog;
            Script.Free;
          end;
      end;
    end;
end;

begin
  ClearSystemRestore;
end.