Вирус exe.emorhc.bat, exe.xoferif.bat

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\4CFA~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE','');
 QuarantineFile('c:\Users\All Users\dtdata\R002.exe','');
 QuarantineFile('C:\Windows\winstart.bat','');
 QuarantineFile('C:\Users\Роман\AppData\Local\Kometa\kometaup.exe','');
 QuarantineFile('C:\Users\Роман\AppData\Local\Kometa\Panel\KometaLaunchPanel.exe','');
 QuarantineFile('C:\Users\Роман\AppData\Roaming\Browsers\exe.emorhc.bat','');
 DeleteFile('C:\Users\Роман\AppData\Roaming\Browsers\exe.emorhc.bat','32');
 DeleteFile('C:\Users\Роман\AppData\Local\Kometa\Panel\KometaLaunchPanel.exe','32');
 DeleteFile('C:\Users\Роман\AppData\Local\Kometa\kometaup.exe','32');
 DeleteFile('C:\Users\Роман\AppData\Local\MediaGet2\mediaget.exe','32');
 DeleteFile('c:\Users\All Users\dtdata\R002.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\DefaultCheck','32');
 DeleteFile('C:\Windows\system32\Tasks\DigitalSite','32');
 DeleteFile('C:\Users\4CFA~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE','32');
 DeleteFile('C:\Users\Роман\AppData\Roaming\omiga-plus\UninstallManager.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\{4B2A4693-D6F0-4072-8D54-4397A69E2894}','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','afazwcbpcj');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KometaLaunchPanel','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\kometaup','command');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MediaGet2');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(9); 
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-878927640-4104331994-3535684356-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files\Arc\Plugins\ArcPluginIE.dll No File
BHO: No Name -> {d1dac034-9fd9-4c13-a388-d2e10e57707f} ->  No File
BHO: No Name -> {D5FEC983-01DB-414a-9456-AF95AC9ED7B5} ->  No File
Toolbar: HKLM - No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
Toolbar: HKLM - No Name - {d1dac034-9fd9-4c13-a388-d2e10e57707f} -  No File
Toolbar: HKU\.DEFAULT -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
Toolbar: HKU\S-1-5-21-878927640-4104331994-3535684356-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
Toolbar: HKU\S-1-5-21-878927640-4104331994-3535684356-1000 -> No Name - {4F524A2D-5350-4500-76A7-7A786E7484D7} -  No File
Toolbar: HKU\S-1-5-21-878927640-4104331994-3535684356-1000 -> No Name - {4F524A2D-5354-2D53-5045-7A786E7484D7} -  No File
Handler: base64 - No CLSID Value - 
Handler: chrome - No CLSID Value - 
Handler: prox - No CLSID Value - 
DefaultPrefix: => http://fratgaser.biz/?searchid=1&l10n=ru&fromsearch=1&imsid=2ed817c429cd4d94fa772fb53a9fcfe8&text= <==== ATTENTION
S2 nylutiku; C:\Program Files\00000000-1438453859-0000-0000-50E5499F0CA0\knsc69D3.tmpfs [X]
S1 iSafeKrnlMon; \??\C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Users\Роман\AppData\Local\Temp\kometa_vd.exe
C:\Users\Роман\AppData\Local\Temp\mailruhomesearchvbm.exe
C:\Users\Роман\AppData\Local\Temp\mediaget-uninstaller.exe
C:\Users\Роман\AppData\Local\Temp\mrutmp.exe
C:\Users\Роман\AppData\Local\Temp\pps-qq-19.exe
C:\Users\Роман\AppData\Local\Temp\vuupc.exe
Reboot: