Баннер Ads by TorqueChallenger в Chrome

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
TerminateProcessByName('c:\program files (x86)\video saver\svc\localserver.exe');
 TerminateProcessByName('c:\program files (x86)\video saver\svc\service.exe');
 SetServiceStart('VideoSaverSvc', 4);
 QuarantineFile('C:\Users\acer\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe','');
 QuarantineFile('C:\Program Files (x86)\Video Saver\hi_aLWO.exe.exe','');
 QuarantineFile('C:\Windows\system32\drivers\tbfd_1_10_0_16.sys','');
 QuarantineFile('c:\program files (x86)\video saver\svc\service.exe','');
 QuarantineFile('c:\users\acer\appdata\roaming\acewebextension\updater\ace_web_extension.exe','');
 QuarantineFile('c:\program files (x86)\video saver\svc\localserver.exe','');
 DeleteFile('c:\program files (x86)\video saver\svc\localserver.exe','32');
 DeleteFile('c:\users\acer\appdata\roaming\acewebextension\updater\ace_web_extension.exe','32');
 DeleteFile('c:\program files (x86)\video saver\svc\service.exe','32');
 DeleteFile('C:\Windows\system32\drivers\tbfd_1_10_0_16.sys','32');
 DeleteFile('C:\Program Files (x86)\Video Saver\hi_aLWO.exe.exe','32');
 DeleteFile('C:\Windows\Tasks\Update Service for Video Saver.job','32');
 DeleteFile('C:\Windows\Tasks\Update Service for Video Saver2.job','32');
 DeleteFile('C:\Windows\system32\Tasks\Update Service for Video Saver','64');
 DeleteFile('C:\Windows\system32\Tasks\Update Service for Video Saver2','64');
 DeleteFile('C:\Users\acer\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe','32');
  DeleteService('VideoSaverSvc');
 DeleteService('tbfd_1_10_0_16');
 BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

VirTool.Obfuscator, D:\game\NBA 2K14\rld.dll, , [ed738fa2612a3bfbf002dc2a50b18977],

start
CreateRestorePoint:
HKU\S-1-5-21-1557219136-2245801360-2196766627-1000\...\Run: [amigo] => [X]
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-1557219136-2245801360-2196766627-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKU\S-1-5-21-1557219136-2245801360-2196766627-1000\Software\Microsoft\Internet Explorer\Main,Start Page = utm_source=startpage03&utm_content=c0db5dd53ba4d8e4888d86f7395aee90
SearchScopes: HKU\S-1-5-21-1557219136-2245801360-2196766627-1000 -> DefaultScope {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1557219136-2245801360-2196766627-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
CHR HomePage: Default -> hxxp://www.search.ask.com/?gct=hp
CHR DefaultSearchURL: Default -> hxxp://www.search.ask.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.ask.com
CHR DefaultSuggestURL: Default -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [mfmjpfoggikolkfilofbpgcnhdcgahib] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pfjgibhmcgncmjhdodpaolfbjpjjajal] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgaidlfgjkmeendhknafahppllbniejm] - hxxps://clients2.google.com/service/update2/crx
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\acer\AppData\Roaming\Opera Software\Opera Stable\Extensions\akimgimeeoiognljlfchpbkpfbmeapkh [2015-06-07]
OPR Extension: (No Name) - C:\Users\acer\AppData\Roaming\Opera Software\Opera Stable\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2015-05-27]
2015-09-18 19:10 - 2015-04-04 16:03 - 00000000 ____D C:\Users\acer\AppData\Roaming\.ACEStream
2015-09-18 19:10 - 2015-04-04 16:01 - 00000000 ____D C:\Users\acer\AppData\Roaming\ACEStream
2015-09-15 21:46 - 2015-04-04 16:05 - 00000000 ___HD C:\_acestream_cache_
2015-04-26 12:10 - 2015-06-07 12:36 - 0000000 _____ () C:\Users\acer\AppData\Roaming\smw_inst
Task: {5B1EA0C1-48C6-40A2-9954-24220C677F80} - \chrome5_logon -> No File <==== ATTENTION
Task: {903945D2-01ED-477A-B6EF-E062DD70845B} - \nethost task -> No File <==== ATTENTION
Task: {C0D1B657-C45E-44B7-94EF-5F35150D7157} - \chrome5 -> No File <==== ATTENTION

cmd: ipconfig /flushdns
cmd: ipconfig /release
cmd: ipconfig /renew
EmptyTemp:
Reboot:
end