Очередной bkrfdf.xyz

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\Сергей\appdata\roaming\svchost.exe','');
 QuarantineFile('C:\Users\Сергей\appdata\roaming\daemon2.exe','');
 QuarantineFile('C:\WINDOWS\proxy.exe','');
 QuarantineFile('C:\Users\Сергей\AppData\Roaming\1H1Q1V1N1N1S1R\WinRAR Packages\uninstaller.exe','');
 QuarantineFile('C:\Users\Сергей\AppData\Roaming\1H1Q1V1N1N1S1R\WinRAR Packages','');
 QuarantineFile('C:\Users\Сергей\AppData\Local\GeoLocator\perfchecker.exe','');
 QuarantineFile('C:\Program Files (x86)\Futesp\mple.exe','');
 QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','');
 QuarantineFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe','');
 DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarGameBrowser.exe','32');
 DeleteFile('C:\Program Files (x86)\Zaxar\ZaxarLoader.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\InternetA','64');
 DeleteFile('C:\Users\Сергей\AppData\Local\GeoLocator\perfchecker.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\Microsoft\Windows\Wininet\PerfChecker','64');
 DeleteFile('C:\Users\Сергей\AppData\Roaming\1H1Q1V1N1N1S1R\WinRAR Packages','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{DD6F5290-3351-40D2-B18B-5466FB031640}','64');
 DeleteFile('C:\Users\Сергей\AppData\Roaming\1H1Q1V1N1N1S1R\WinRAR Packages\uninstaller.exe','32');
 DeleteFile('C:\WINDOWS\proxy.exe','32');
 DeleteFile('C:\Users\Сергей\appdata\roaming\daemon2.exe','32');
 DeleteFile('C:\Users\Сергей\appdata\roaming\svchost.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Сергей');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarLoader');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ZaxarGameBrowser');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
HKLM-x32\...\Run: [sun3] => [X]
HKLM-x32\...\Run: [mpck_en_005030250] => [X]
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-1062487990-2013888824-386495607-1002\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR Extension: (Fast search) - C:\Users\Сергей\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-10-02]
CHR HKLM-x32\...\Chrome\Extension: [hpcghcdjnehpkdecaflpedhklimnejia] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iflppbjnpneiigcbdfjpnkebidmkjmoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [jaeahnnfohikjnejpokeaaiinijhpfop] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pfigaoamnncijbgomifamkmkidnnlikl] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pnooffjhclkocplopffdbcdghmiffhji] - hxxps://clients2.google.com/service/update2/crx
C:\Users\Сергей\AppData\Local\Temp\libeay32.dll
C:\Users\Сергей\AppData\Local\Temp\msvcr120.dll
C:\Users\Сергей\AppData\Local\Temp\sqlite3.dll
Task: {1004B5BF-DB05-4B28-909D-86D58083FA69} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {156D2C59-2330-45D0-AAA2-91DDD737B8D9} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {1D18EF8C-D83E-41FA-BDAC-6B82C3824A15} - \InternetA -> No File <==== ATTENTION
Task: {1D1B44FE-3880-47EF-9DFA-5266A8FEFCAA} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {4405D7FC-200D-451F-8BC6-FBE233F33A4A} - \Microsoft\Windows\Setup\EOONotify -> No File <==== ATTENTION
Task: {4F8A8390-ADA3-4F8C-ACF3-C2587C5D42E7} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {54F34234-834A-48DE-99E8-51E2F15FA4E0} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {62E59867-EE19-4806-9544-1BF9851353DC} - \WPD\SqmUpload_S-1-5-21-1062487990-2013888824-386495607-1005 -> No File <==== ATTENTION
Task: {75164C1B-54B4-49D1-B9C9-E9809EFF5E8D} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {8772337B-A4A8-4A51-8EB2-31D555B440E5} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {8925F293-55A0-4C0F-B63D-32AFEA600D12} - \Обновление Браузера Яндекс  -> No File <==== ATTENTION
Task: {8A8C0148-7A6E-443C-8F76-D499C1662436} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {9D529E9F-F76C-492E-8D7E-34055F150FF4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {AF1B455A-B536-4216-8A29-FA217E7B5B00} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {AFA31CC5-05A2-4547-8719-1BDF9E093DC0} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {B883FB84-BFF8-44A8-93DE-47EB58AD7F5A} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D8E98B9A-034C-4FD6-8AE1-5652636CCA80} - \WPD\SqmUpload_S-1-5-21-1062487990-2013888824-386495607-1002 -> No File <==== ATTENTION
Task: {DAA981DE-1823-477A-9A3E-9D4663857F62} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {E2908359-67CF-443F-A539-4F8BF74A7BB3} - \{DD6F5290-3351-40D2-B18B-5466FB031640} -> No File <==== ATTENTION
Task: {E358B6A5-D621-4657-A5FB-8CC5024BC124} - \Microsoft\Windows\Wininet\PerfChecker -> No File <==== ATTENTION
Task: {E5FC95A7-A88D-4425-A1FE-F35E5FC2E926} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {E77B79C3-A2C8-4FF8-AD10-AA4393965348} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Reboot: