Переадресация на mail.ru и реклама в браузере

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Program Files\Yandex\Punto Switcher\punto.bat','');
 QuarantineFile('C:\Users\Пользователь\AppData\Local\Kometa\Application\kometa.bat','');
 SetServiceStart('MaskitService', 4);
 SetServiceStart('netfilter2', 4);
 DeleteService('netfilter2');
 DeleteService('MaskitService');
 QuarantineFile('C:\Windows\system32\drivers\netfilter2.sys','');
 QuarantineFile('C:\Program Files\Maskit\MaskitService.exe','');
 DeleteFile('C:\Program Files\Maskit\MaskitService.exe','32');
 DeleteFile('C:\Windows\system32\drivers\netfilter2.sys','32');
 DeleteFile('C:\Users\Пользователь\AppData\Local\Kometa\Application\kometa.bat','32');
 DeleteFile('C:\Program Files\Yandex\Punto Switcher\punto.bat','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-1518045118-243451894-482144375-1000 -> No Name - {09900DE8-1DCA-443F-9243-26FF581438AF} -  No File
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\b1kvqhtp.default -> Ask.com
OPR Extension: (Fast search) - C:\Users\Пользователь\AppData\Roaming\Opera Software\Opera Stable\Extensions\pbdpajcdgknpendpmecafmopknefafha [2017-06-08]
OPR StartupUrls: "hxxp://www.istartsurf.com/?type=hp&ts=1438747152&z=86f0baec5e8d47fac071fdcgbz8ccbbmczcm6o0qac&from=cor&uid=ST1000DM003-1CH162_Z1D1MFJ6XXXXZ1D1MFJ6"
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
2017-06-08 16:37 - 2017-06-08 16:38 - 0924432 _____ (Star Line                                                   ) C:\Users\Пользователь\AppData\Local\Temp\maskitinstaller.exe
Task: {F5AC0787-B7F6-4CB8-B987-57F4CAAE8339} - \Microsoft\Windows\Media Center\PvrScheduleTask -> No File <==== ATTENTION
Task: {5C0EA71E-4916-4411-B031-D96BA99F9532} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask -> No File <==== ATTENTION
Task: {74A59384-ED3E-496D-9889-61EAE507EA24} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask -> No File <==== ATTENTION
Task: {258042FC-753D-4806-85FF-51BFF23654EA} - \{98038CA0-02FB-466E-923F-9F0C6EDFCB0F} -> No File <==== ATTENTION
Task: {10ECF4E2-9725-418F-98CE-8EA9C86FC0A9} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask -> No File <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-1518045118-243451894-482144375-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\Пользователь\AppData\Local\Google\Update\1.3.21.65\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-1518045118-243451894-482144375-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Пользователь\AppData\Local\Google\Update\1.3.22.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-1518045118-243451894-482144375-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Пользователь\AppData\Local\Google\Update\1.3.21.111\psuser.dll => No File
Reboot: