Перенаправление из поиска google в поиск mail + открытие рекламы и баннеров практически на любом сайте

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 SetServiceStart('MPCKpt', 4);
 QuarantineFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\fupdate\fupdate.exe','');
 QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe','');
 QuarantineFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\3E93840E-5FBD-4D87-9251-0F0DE4A26975.exe','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\MPCKpt.sys','');
 QuarantineFile('C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe','');
 DeleteFile('C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe','32');
 DeleteFile('C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe','32');
 DeleteFile('C:\WINDOWS\system32\DRIVERS\MPCKpt.sys','32');
 DeleteFile('C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\3E93840E-5FBD-4D87-9251-0F0DE4A26975.exe','32');
 DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\fupdate\fupdate.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\fupdate','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\KRBUUS\KRB Updater Utility Service','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\KRBUUS\KRBLNKRUN','64');
 DeleteFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\Windows\AB8557833-BAD2-47D5-9A3A-5B2B6ECD5FF8','64');
 DeleteService('MPCProtectService');
 DeleteService('MPCKpt');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
HKLM\...\Policies\Explorer\Run: [B8557833-BAD2-47D5-9A3A-5B2B6ECD5FF8] => C:\Program Files (x86)\Common Files\Adobe\OOBA\PDApp\PPAPI\3E93840E-5FBD-4D87-9251-0F0DE4A26975.exe
HKLM\...\Policies\Explorer\Run: [KRB Updater Utility] => C:\ProgramData\KRB Updater Utility\krbupdater.exe
HKU\S-1-5-21-2747587422-3098697386-1289943337-1002\...\RunOnce: [Uninstall C:\Users\**>;L7>20B5;L\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64<*>] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64" <===== ATTENTION (Value Name with invalid characters)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileSyncShell64.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Пользователь\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\FileSyncShell.dll No File
ProxyServer: [S-1-5-21-2747587422-3098697386-1289943337-1002] => 127.0.0.1:18159
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [X]
S2 MPCProtectService; "C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe" [X]
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-08-24] (DotC United Inc)
2016-08-24 14:34 - 2016-08-24 14:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
2016-08-24 14:27 - 2016-08-24 14:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC Desktop
2016-08-24 14:27 - 2016-08-24 14:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC AdCleaner
2016-08-24 13:53 - 2016-08-24 14:52 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-08-24 13:53 - 2016-08-24 13:53 - 00060136 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
2016-08-24 13:53 - 2016-08-24 13:53 - 00000000 ____D C:\Users\User\AppData\Local\Вoйти в Интeрнет
2016-08-24 13:51 - 2016-08-24 13:51 - 00000000 ____D C:\Users\User\AppData\Local\fupdate
2016-08-24 13:50 - 2016-08-24 21:38 - 00000000 ____D C:\Users\User\AppData\Local\ScriptWriter
2016-08-24 13:48 - 2016-08-24 14:05 - 00000000 ____D C:\Program Files (x86)\Kinoroom Browser
2016-08-24 13:48 - 2016-08-24 13:48 - 00000000 ____D C:\Users\User\AppData\Local\Поиcк в Интeрнете
C:\Users\User\AppData\Local\Temp\3vPW32wyxdRJ.exe
C:\Users\User\AppData\Local\Temp\cfZhV96zly3k.exe
C:\Users\User\AppData\Local\Temp\coi1633.exe
C:\Users\User\AppData\Local\Temp\fx_brows.exe
C:\Users\User\AppData\Local\Temp\gUuzmT941dmE.exe
C:\Users\User\AppData\Local\Temp\ijJzzf7bnJ9D.exe
C:\Users\User\AppData\Local\Temp\lfs.exe
C:\Users\User\AppData\Local\Temp\lfSJ4eBhNcy3.exe
C:\Users\User\AppData\Local\Temp\M1FfY6vKLFGI.exe
C:\Users\User\AppData\Local\Temp\MPCSetup_4.3.exe
C:\Users\User\AppData\Local\Temp\NfvqvyIHMjFw.exe
C:\Users\User\AppData\Local\Temp\ocFjnR7qbHnB.exe
C:\Users\User\AppData\Local\Temp\QV6fO1wawuzF.exe
C:\Users\User\AppData\Local\Temp\setup_.exe
C:\Users\User\AppData\Local\Temp\tnzJNvWycktJ.exe
C:\Users\User\AppData\Local\Temp\W6x3uDT5Wb2S.exe
C:\Users\User\AppData\Local\Temp\x5LjmKXTd6te.exe
C:\Users\User\AppData\Local\Temp\Y028vluQv65S.exe
Task: {4121EC95-5CA4-40E2-A209-E8D5BBE0EEC1} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {42757636-CC6D-41FA-83FF-2F576BD4F348} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {4BEE524F-E89D-437E-8725-DBB82703F378} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {50BCDFAE-0D82-40F7-9259-1B90C02585BF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {5F1383A4-44BD-4891-ADA4-00BDF8AC2BC8} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {5FD78CC7-3345-4F21-8C4B-88A7321B233F} - \fupdate -> No File <==== ATTENTION
Task: {6556581B-16D1-4CA9-AB74-3CFAF9DE0B5B} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {780F5FFB-B967-49C5-A65E-E3245DB4D50A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {821D5DEA-1F87-4827-9DD7-CD8C06AEC396} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8DA79E62-9CC1-44DF-BA94-6FADC388C7FB} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {90D2E312-6288-4F59-9ED3-3F5839AC58A8} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {975E5B07-CE3F-450C-8D0E-6B9898A7CB93} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {9C506CA1-9BBE-42BB-B6E7-D16DFCF17284} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {A6543958-E7A3-44AE-8E85-4146CB0C41B0} - \Microsoft\KRBUUS\KRBLNKRUN -> No File <==== ATTENTION
Task: {C6472857-CBCB-41A8-9557-7DB970268B08} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CA717EE9-E2A0-4C9F-ACD1-95300D99060F} - \Microsoft\Windows\AB8557833-BAD2-47D5-9A3A-5B2B6ECD5FF8 -> No File <==== ATTENTION
Task: {CB4519B6-8323-4C3B-A762-04C76B26D5EB} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {DC34A20F-8FCF-499B-BBE0-489810ED3417} - \Microsoft\KRBUUS\KRB Updater Utility Service -> No File <==== ATTENTION
Task: {E559403B-9420-41BA-AE1A-BB12DBCCF897} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {FD5E9402-301A-4E64-AABC-26327458C5BB} - \Microsoft\Windows\Setup\EOSNotify -> No File <==== ATTENTION
Reboot: