[iskander-k]

Сначала нужно удалить mystartsearch

для этого выполните

Панель управления\Программы и компоненты" удалить
mystartsearch
WindowsMangerProtect
xtab,
HDQ-1.2cV06


После этого


• Скрипт AVZ.
Выполните скрипт AVZ. Меню Файл - Выполнить скрипт, вставляем написаный скрипт - кнопка Запустить, после выполнения компьютер перезагрузится.

Код:

begin
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe  /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-7.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-6.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-5.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-4.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-3.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-11.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\HDQ-1.2cV06.01-codedownloader.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe','');
 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','');
 QuarantineFile('C:\ProgramData\WindowsMangerPro','');
 QuarantineFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe','');
 QuarantineFile('C:\Program Files (x86)\XTab\ProtectService.exe','');
 SetServiceStart('ccnfd_1_10_0_5', 4);
 DeleteService('ccnfd_1_10_0_5');
 StopService('ccnfd_1_10_0_5');
 SetServiceStart('WindowsMangerProtect', 4);
 DeleteService('WindowsMangerProtect');
 StopService('WindowsMangerProtect');
 SetServiceStart('IHProtect Service', 4);
 DeleteService('IHProtect Service');
 StopService('IHProtect Service');
 QuarantineFile('C:\Windows\system32\drivers\ccnfd_1_10_0_5.sys','');
 QuarantineFile('C:\Program Files (x86)\XTab\IeWatchDog.dll','');
 QuarantineFile('C:\Program Files (x86)\XTab\BrowserAction.dll','');
 QuarantineFile('C:\Program Files (x86)\XTab\BrowerWatchFF.dll','');
 QuarantineFile('C:\Program Files (x86)\XTab\BrowerWatchCH.dll','');
 TerminateProcessByName('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe');
 QuarantineFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','');
 TerminateProcessByName('c:\program files (x86)\xtab\protectservice.exe');
 QuarantineFile('c:\program files (x86)\xtab\protectservice.exe','');
 TerminateProcessByName('c:\program files (x86)\xtab\hpnotify.exe');
 TerminateProcessByName('c:\program files (x86)\xtab\cmdshell.exe');
 QuarantineFile('c:\program files (x86)\xtab\hpnotify.exe','');
 QuarantineFile('c:\program files (x86)\xtab\cmdshell.exe','');
 DeleteFile('c:\program files (x86)\xtab\cmdshell.exe','32');
 DeleteFile('c:\program files (x86)\xtab\hpnotify.exe','32');
 DeleteFile('c:\program files (x86)\xtab\protectservice.exe','32');
 DeleteFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','32');
 DeleteFile('C:\Program Files (x86)\XTab\BrowerWatchCH.dll','32');
 DeleteFile('C:\Program Files (x86)\XTab\BrowerWatchFF.dll','32');
 DeleteFile('C:\Program Files (x86)\XTab\BrowserAction.dll','32');
 DeleteFile('C:\Program Files (x86)\XTab\IeWatchDog.dll','32');
 DeleteFile('C:\Windows\system32\drivers\ccnfd_1_10_0_5.sys','32');
 DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe','32');
 DeleteFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe','32');
 DeleteFile('C:\ProgramData\WindowsMangerPro','32');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','32');
 DeleteFile('C:\Windows\Tasks\2aa9331d-9811-46ea-854e-72cc44b9c10c.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe','32');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\HDQ-1.2cV06.01-codedownloader.exe','32');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-1.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-11.exe','32');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-3.exe','32');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-4.exe','32');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-5.exe','32');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-11.job','64');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-3.job','64');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-4.job','64');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5.job','64');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5_user.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-6.exe','32');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-6.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-7.exe','32');
 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-7.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.exe','32');
 DeleteFile('C:\Windows\Tasks\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.job','64');
 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe  /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','32');
 DeleteFile('C:\Windows\system32\Tasks\2aa9331d-9811-46ea-854e-72cc44b9c10c','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-1','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-11','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-3','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-4','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-6','64');
 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-7','64');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
BC_Activate;
RebootWindows(true);
end.

После всех процедур выполните скрипт

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.