В браузерах при нажатии на ссылки или любое место на странице открывается окно с рекламой

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
TerminateProcessByName('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.exe');
 TerminateProcessByName('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\10\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\8\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\2\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\7\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\12\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\3\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\5\plugin.exe');
 TerminateProcessByName('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugincontainer.exe');
 TerminateProcessByName('c:\program files (x86)\common files\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\updater.exe');
 SetServiceStart('Service Mgr MagicalFind', 4);
 SetServiceStart('Update Mgr MagicalFind', 4);
QuarantineFile('C:\Program Files (x86)\Picexa\uninstall.exe','');
 QuarantineFile('C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-7.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-5.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-4.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-10.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-7.exe','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.exe','');
 QuarantineFile('C:\ProgramData\Schedule\timetasks.exe','');
 QuarantineFile('C:\Users\Sholpan\AppData\Roaming\eTranslator\eTranslator.exe','');
 QuarantineFile('C:\Users\Sholpan\AppData\Local\Temp\{3F6D40D3-6AC4-4F36-8035-468B82541D99}.dll','');
 QuarantineFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\ca634213-daed-4542-861b-c3e5204aa8a7.dll','');
 QuarantineFile('c:\program files (x86)\common files\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\updater.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugincontainer.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\5\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\3\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\2\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\7\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\12\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\8\plugin.exe','');
 QuarantineFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\10\plugin.exe','');
 QuarantineFile('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.exe','');
 QuarantineFile('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.exe','');
 DeleteFile('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.exe','32');
 DeleteFile('c:\program files (x86)\totalplushd-3.1v07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\10\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\8\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\12\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\7\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\2\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\3\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugins\5\plugin.exe','32');
 DeleteFile('c:\programdata\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\plugincontainer.exe','32');
 DeleteFile('c:\program files (x86)\common files\1c1e4ef3-a4fe-42a4-a546-08f69e47d2d1\updater.exe','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\ca634213-daed-4542-861b-c3e5204aa8a7.dll','32');
 DeleteFile('C:\Users\Sholpan\AppData\Local\Temp\{3F6D40D3-6AC4-4F36-8035-468B82541D99}.dll','32');
 DeleteFile('C:\Program Files (x86)\YTDownloader\YTDownloader.exe','32');
 DeleteFile('C:\Users\Sholpan\AppData\Roaming\eTranslator\eTranslator.exe','32');
 DeleteFile('C:\ProgramData\Schedule\timetasks.exe','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6.job','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-7.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-7.job','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-10.exe','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-4.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-4.job','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-10_user.job','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-5.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-5.job','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-5_user.job','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.exe','32');
 DeleteFile('C:\Program Files (x86)\TotalPlusHD-3.1V07.02\6db310e8-270b-45b1-a8e2-2196a1c871b3-7.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-7.job','32');
 DeleteFile('C:\WINDOWS\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-6.job','32');
 DeleteFile('C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job','32');
 DeleteFile('C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-6','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-1-7','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-10_user','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-4','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-5','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-5_user','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-6','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\6db310e8-270b-45b1-a8e2-2196a1c871b3-7','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\globalUpdateUpdateTaskMachineCore','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\globalUpdateUpdateTaskMachineUA','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\LaunchSignup','64');
 DeleteFile('C:\Users\Sholpan\AppData\Roaming\webssearches\UninstallManager.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{97144E12-5D46-4E54-8D62-396FE5332644}','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\{36723E6F-A543-4917-828A-9791D96A3B08}','64');
 DeleteFile('C:\Program Files (x86)\Picexa\uninstall.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{9C9BF0AF-3ECB-4112-B9CB-F231A5CCF998}','64');
 DeleteService('Update Mgr MagicalFind');
 DeleteService('Service Mgr MagicalFind');
 DeleteService('iSafeKrnlMon');
 BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.