Самовольно открывается рекламная вкладка в браузере + сам браузер

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 TerminateProcessByName('c:\users\777\appdata\roaming\checkers\draughts\draughts.exe');
 QuarantineFileF('c:\users\777\appdata\roaming\checkers', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\777\appdata\local\adobe\ppapi\bc761984-ac8f-4222-bcea-efa8ee076406', '*', true, '', 0 ,0);
 QuarantineFileF('c:\programdata\krb updater utility', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\programdata\tmp0x0x', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\program files\spacesoundpro', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\users\777\appdata\local\fupdate', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('c:\program files (x86)\kinoroom browser', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFile('c:\users\777\appdata\roaming\checkers\draughts\draughts.exe', '');
 QuarantineFile('C:\Program Files (x86)\6DD5D5DF-1450121936-C440-ABD1-10C37B5721DF\knsn34A7.tmp', '');
 QuarantineFile('C:\Program Files (x86)\6DD5D5DF-1451232513-C440-ABD1-10C37B5721DF\knsl2CB5.tmpfs', '');
 QuarantineFile('C:\Program Files (x86)\6DD5D5DF-1451232513-C440-ABD1-10C37B5721DF\hnst73F7.tmp', '');
 QuarantineFile('C:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol', '');
 QuarantineFile('C:\Users\777\AppData\Roaming\daemon2.exe', '');
 QuarantineFile('C:\Users\777\AppData\Local\Adobe\PPAPI\BC761984-AC8F-4222-BCEA-EFA8EE076406\EBBC8BB0-E61B-48E2-B2E7-E0CDC53EB422.exe', '');
 QuarantineFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe', '');
 QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '');
 QuarantineFile('C:\ProgramData\tMPdXhsBI\wdSCreloS0.bat', '');
 QuarantineFile('C:\ProgramData\giaoDSuqAwTstq\okfdan5.bat', '');
 QuarantineFile('C:\Users\777\AppData\Local\fupdate\fupdate.exe', '');
 QuarantineFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe', '');
 ExecuteFile('schtasks.exe', '/delete /TN "fupdate" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "KRB Updater Utility Service" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "KRBLNKRUN" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ABC761984-AC8F-4222-BCEA-EFA8EE076406" /F', 0, 15000, true);
 DeleteFile('c:\users\777\appdata\roaming\checkers\draughts\draughts.exe', '32');
 DeleteFile('C:\Program Files (x86)\6DD5D5DF-1450121936-C440-ABD1-10C37B5721DF\knsn34A7.tmp', '32');
 DeleteFile('C:\Program Files (x86)\6DD5D5DF-1451232513-C440-ABD1-10C37B5721DF\knsl2CB5.tmpfs', '32');
 DeleteFile('C:\Program Files (x86)\6DD5D5DF-1451232513-C440-ABD1-10C37B5721DF\hnst73F7.tmp', '32');
 DeleteFile('C:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol', '32');
 DeleteFile('C:\Users\777\AppData\Roaming\daemon2.exe', '32');
 DeleteFile('C:\Users\777\AppData\Local\Adobe\PPAPI\BC761984-AC8F-4222-BCEA-EFA8EE076406\EBBC8BB0-E61B-48E2-B2E7-E0CDC53EB422.exe', '32');
 DeleteFile('C:\ProgramData\KRB Updater Utility\krbupdater.exe', '32');
 DeleteFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe', '32');
 DeleteFile('C:\ProgramData\tMPdXhsBI\wdSCreloS0.bat', '32');
 DeleteFile('C:\ProgramData\giaoDSuqAwTstq\okfdan5.bat', '32');
 DeleteFile('C:\Users\777\AppData\Local\fupdate\fupdate.exe', '32');
 DeleteFile('C:\Program Files (x86)\Kinoroom Browser\krbrowser.exe', '32');
 DeleteFileMask('c:\users\777\appdata\roaming\checkers', '*', true);
 DeleteFileMask('c:\programdata\krb updater utility', '*', true);
 DeleteFileMask('c:\programdata\tmp0x0x', '*', true);
 DeleteFileMask('c:\program files\spacesoundpro', '*', true);
 DeleteFileMask('c:\users\777\appdata\local\fupdate', '*', true);
 DeleteFileMask('c:\program files (x86)\kinoroom browser', '*', true);
 DeleteDirectory('c:\users\777\appdata\roaming\checkers');
 DeleteDirectory('c:\programdata\krb updater utility');
 DeleteDirectory('c:\programdata\tmp0x0x');
 DeleteDirectory('c:\program files\spacesoundpro');
 DeleteDirectory('c:\users\777\appdata\local\fupdate');
 DeleteDirectory('c:\program files (x86)\kinoroom browser');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','C');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Daemon');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Draughts');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','BC761984-AC8F-4222-BCEA-EFA8EE076406');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','KRB Updater Utility');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SpaceSoundPro');
 DeleteService('fymoziry');
 DeleteService('vuzemiko');
 DeleteService('wucotusy');
ExecuteSysClean;
 ExecuteRepair(4);
 ExecuteWizard('SCU', 2, 3, true);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.