Реклама в ВК и программы от майл. ру

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\Admin\AppData\Local\FilterStart\FilterStart.exe','');
 QuarantineFile('C:\Users\Admin\AppData\Roaming\Identities\ISSCH\issch.exe','');
 QuarantineFile('C:\Users\Admin\AppData\Local\fupdate\fupdate.exe','');
 QuarantineFile('C:\Program Files (x86)\ScreenUp\future_helper.exe','');
 DeleteFile('C:\Program Files (x86)\ScreenUp\future_helper.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\Account Standart Manager','64');
 DeleteFile('C:\Windows\system32\Tasks\fupdate','64');
 DeleteFile('C:\Users\Admin\AppData\Local\fupdate\fupdate.exe','32');
 DeleteFile('C:\Users\Admin\AppData\Roaming\Identities\ISSCH\issch.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\InstallShield Update Service','64');
 DeleteFile('C:\Windows\system32\Tasks\Render Account Manager','64');
 DeleteFile('C:\Windows\system32\Tasks\Standart PC Manager','64');
 DeleteFile('C:\Users\Admin\AppData\Local\FilterStart\FilterStart.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
Task: {1C834EC8-08B8-4DD9-9C8E-6C895D9B1FD5} - \Account Standart Manager -> No File <==== ATTENTION
Task: {3305ABED-22BC-407E-800F-A212C0C5C900} - \Render Account Manager -> No File <==== ATTENTION
Task: {607EA095-6877-42A9-BEF0-277E0D0172AF} - \Standart PC Manager -> No File <==== ATTENTION
Task: {AEF37D4E-B426-4C9A-B856-1F075EE92B4C} - \InstallShield Update Service -> No File <==== ATTENTION
Task: {F9B1B04F-C64A-4C49-8CE0-D908AA203B02} - \fupdate -> No File <==== ATTENTION
HKLM\...\Run: [DateOption] => C:\Users\Admin\AppData\Local\DateOption\regCheck.vbs www.syschecksync.com/?rnd=141 0 0
HKLM\...\Policies\Explorer\Run: [TestMenu] => C:\Users\Admin\AppData\Local\TestMenu\regCheck.vbs www.testmenu.xyz
HKLM\...\Policies\Explorer\Run: [ImmediateHelp] => C:\Users\Admin\AppData\Local\ImmediateHelp\regCheck.vbs www.2road.xyz
HKU\S-1-5-21-3872502490-3609556252-3981559996-1000\...\Policies\Explorer\Run: [LastNews] => C:\Users\Admin\AppData\Local\LastNews\regCheck.vbs www.snowyear.xyz
HKU\S-1-5-21-3872502490-3609556252-3981559996-1000\...\Policies\Explorer\Run: [ValidateLife] => C:\Users\Admin\AppData\Local\ValidateLife\regCheck.vbs www.hitopup.xyz
CHR StartupUrls: Default -> "","hxxp://mail.ru/cnt/7993/","hxxp://www.google.com/","hxxp://mail.ru/cnt/10445?gp=blackbear12","hxxp://www.istartsurf.com/?type=hp&ts=1437518107&z=7dfb159aae00ac9ba353ef4g2z7c7m6w0gcbaeamfz&from=face&uid=WDCXWD10EZEX-00ZF5A0_WD-WMC1S352973129731","hxxp://www.istartsurf.com/?type=hppp&ts=1437518209&z=f34f7aa9ebae90e067e80e9gdz5cfm6wcg3bdg1m3q&from=face&uid=WDCXWD10EZEX-00ZF5A0_WD-WMC1S352973129731","hxxp://mail.ru/cnt/10445?gp=anvir5","hxxp://mail.ru/cnt/10445?gp=820475","hxxp://mail.ru/cnt/10445?gp=811009","hxxp://mail.ru/cnt/10445?gp=818408"
CHR Extension: (VK Downloader) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjdlpaffkkdggnabfdbhbfbncmcckio [2016-10-27]
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\ValidateLife
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\TestMenu
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\rightchose
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\LastNews
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\ImmediateHelp
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\FilterOptions
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\FileSystemOptions
2016-10-26 17:39 - 2016-10-26 17:39 - 00000000 ____D C:\Users\Admin\AppData\Local\DateOption
2016-10-23 17:30 - 2016-07-20 20:14 - 00025768 _____ C:\Windows\SysWOW64\sh4native.exe
2016-10-23 17:29 - 2016-10-23 18:25 - 00542910 _____ C:\spyhunter.fix
2016-10-23 17:24 - 2016-10-23 17:24 - 00013312 _____ ( ) C:\Users\Admin\AppData\Local\Standart PC Manager.exe
2016-10-23 17:24 - 2016-10-23 17:24 - 00000326 _____ C:\Users\Admin\AppData\Local\expand.ini
2016-10-23 17:24 - 2016-10-23 17:24 - 00000000 ____D C:\Users\Admin\AppData\Local\Вoйти в Интeрнет
2016-10-23 17:24 - 2016-10-23 17:24 - 00000000 ____D C:\Program Files (x86)\ScreenUp
2016-10-23 17:23 - 2016-10-23 18:46 - 00000000 ____D C:\Users\Admin\AppData\Local\fupdate
2016-10-23 17:22 - 2016-10-24 01:17 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\SearchGo
2016-10-23 17:20 - 2016-10-23 17:20 - 00000000 ____D C:\Users\Admin\AppData\Local\Поиcк в Интeрнете
2016-10-23 17:14 - 2016-10-23 18:46 - 00000000 ____D C:\Program Files (x86)\Enigma Software Group
2016-10-23 16:46 - 2016-10-23 16:46 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
C:\Users\Admin\AppData\Local\Temp\coi1634.exe
C:\Users\Admin\AppData\Local\Temp\Hva8W4ySuWbM.exe
C:\Users\Admin\AppData\Local\Temp\NA9bCurHAlI3.exe
C:\Users\Admin\AppData\Local\Temp\qr3TZ7V2TeHH.exe
Reboot: