В браузере подменяются ссылки на страницы

start
CreateRestorePoint:
HKU\S-1-5-21-2097086837-477200667-3618874420-1000\...\Run: [] => [X]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Interstate82\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
U4 Messenger; No ImagePath
2015-03-22 23:20 - 2015-03-21 11:20 - 0000044 ____H () C:\Program Files (x86)\a9743bea.tmp
C:\Users\Interstate82\AppData\Local\Temp\avgnt.exe
C:\Users\Interstate82\AppData\Local\Temp\bassmod.dll
C:\Users\Interstate82\AppData\Local\Temp\Downloader.exe
C:\Users\Interstate82\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Interstate82\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Interstate82\AppData\Local\Temp\nvStInst.exe
C:\Users\Interstate82\AppData\Local\Temp\Quarantine.exe
C:\Users\Interstate82\AppData\Local\Temp\raptrpatch.exe
C:\Users\Interstate82\AppData\Local\Temp\raptr_stub.exe
C:\Users\Interstate82\AppData\Local\Temp\sqlite3.dll
C:\Users\Interstate82\AppData\Local\Temp\tmpE311.exe
C:\Users\Interstate82\AppData\Local\Temp\Uninstaller-2844.exe
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2097086837-477200667-3618874420-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Interstate82\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
AlternateDataStreams: C:\ProgramData\TEMP:07BF512B
AlternateDataStreams: C:\Users\Все пользователи\TEMP:07BF512B
Reboot:
end

var
LogPath : string;
ScriptPath : string;
begin
 LogPath := GetAVZDirectory + 'log\avz_log.txt';
 if FileExists(LogPath) Then DeleteFile(LogPath);
 ScriptPath := GetAVZDirectory +'ScanVuln.txt';
  if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 1) then ExecuteScript(ScriptPath) else 
begin
    if DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', ScriptPath, 0) then ExecuteScript(ScriptPath) 
else begin
       ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
       exit;
      end;
  end;
 if FileExists(LogPath) Then ExecuteFile('notepad.exe', LogPath, 1, 0, false)
end.