Периодически открывается страница казино Вулкан

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\users\sedyuko\appdata\roaming\battle.net\codexi\steam');
 QuarantineFile('C:\Users\Sedyuko\appdata\local\svshost\svshost.exe','');
 QuarantineFile('C:\Program Files (x86)\ScreenUp\future_helper.exe','');
 QuarantineFile('C:\Users\Sedyuko\AppData\Roaming\PBot\python\pythonw.exe','');
 QuarantineFile('C:\Users\Sedyuko\AppData\Local\FilterStart\FilterStart.exe','');
 QuarantineFile('c:\users\sedyuko\appdata\roaming\battle.net\codexi\steam','');
 DeleteFile('c:\users\sedyuko\appdata\roaming\battle.net\codexi\steam','32');
 DeleteFile('C:\Users\Sedyuko\AppData\Local\FilterStart\FilterStart.exe','32');
 DeleteFile('C:\Users\Sedyuko\AppData\Roaming\PBot\python\pythonw.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\Root Language Helper','64');
 DeleteFile('C:\Windows\system32\Tasks\PBot','64');
 DeleteFile('C:\Windows\system32\Tasks\Custom Language Manager','64');
 DeleteFile('C:\Windows\system32\Tasks\Steam_x64-S-2-106-91','64');
 DeleteFile('C:\Program Files (x86)\ScreenUp\future_helper.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\Trusted Base Helper','64');
 DeleteFile('C:\Users\Sedyuko\appdata\local\svshost\svshost.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','wdphaaydro');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
GroupPolicy: Restriction - Chrome <======= ATTENTION
HKU\S-1-5-21-575804305-2588526881-739444758-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://granena.ru/?utm_content=31b5cebd524a9af6c7a772dca81815e9&utm_source=startpm&utm_term=DCEAA5126524F2BF07A9E7B0BD849496&utm_d=20161201
SearchScopes: HKU\S-1-5-21-575804305-2588526881-739444758-1000 -> {A06ED961-D98F-4CF9-A89B-80AB11DB149C} URL = hxxp://go-search.ru/search?q={searchTerms}
FF Homepage: Mozilla\Firefox\Profiles\xafq7alb.default -> hxxp://granena.ru/?utm_content=31b5cebd524a9af6c7a772dca81815e9&utm_source=startpm&utm_term=DCEAA5126524F2BF07A9E7B0BD849496&utm_d=20161201
FF Extension: (No Name) - C:\Users\Sedyuko\AppData\Roaming\Mozilla\Firefox\Profiles\xafq7alb.default\extensions\yasearch@yandex.ru [not found]
FF Extension: (No Name) - C:\Users\Sedyuko\AppData\Roaming\Mozilla\Firefox\Profiles\xafq7alb.default\extensions\ascsurfingprotection@iobit.com [not found]
FF Extension: (No Name) - C:\Program Files (x86)\IObit Apps Toolbar\FF [not found]
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [pmlghpafmmnmmkjdhacccolfgnkiboco] - C:\Program Files (x86)\1ClickDownload\oneclickdownloader11.crx <not found>
OPR Extension: (No Name) - C:\Users\Sedyuko\AppData\Roaming\Opera Software\Opera Stable\Extensions\khmiehpkiedpkpifcpeplghoibfhhigo [2016-12-02]
2016-12-02 00:10 - 2016-12-02 00:10 - 00000000 ____D C:\Users\Sedyuko\AppData\Local\Вoйти в Интeрнет
2016-12-02 00:09 - 2016-12-02 00:14 - 00000000 ____D C:\Users\Sedyuko\AppData\Roaming\PBot
2016-12-02 00:08 - 2016-12-03 13:42 - 00000000 ____D C:\Users\Sedyuko\AppData\Local\FilterStart
2016-12-02 00:08 - 2016-12-02 00:08 - 00057072 _____ (Windows (R) Win 7 DDK provider) C:\Windows\ServiceMgr.sys
2016-12-02 00:08 - 2016-12-02 00:08 - 00013312 _____ ( ) C:\Users\Sedyuko\AppData\Local\Root Language Helper.exe
2016-12-02 00:08 - 2016-12-02 00:08 - 00000320 _____ C:\Users\Sedyuko\AppData\Local\expand.ini
2016-12-02 00:06 - 2016-12-03 13:41 - 00000000 ____D C:\Users\Sedyuko\AppData\Local\svshost
2016-12-02 00:05 - 2016-12-02 00:05 - 00000000 ____D C:\Users\Sedyuko\AppData\Local\Поиcк в Интeрнете
C:\Users\Sedyuko\AppData\Local\Temp\ANtCWgLNRQhk.exe
C:\Users\Sedyuko\AppData\Local\Temp\bYUAMgbpegwx.exe
C:\Users\Sedyuko\AppData\Local\Temp\ciEyBz2Ohf0I.exe
C:\Users\Sedyuko\AppData\Local\Temp\coi1634.exe
C:\Users\Sedyuko\AppData\Local\Temp\F6CA0MbpUeMW.exe
C:\Users\Sedyuko\AppData\Local\Temp\libeay32.dll
C:\Users\Sedyuko\AppData\Local\Temp\mgFXn9zatHg7.exe
C:\Users\Sedyuko\AppData\Local\Temp\msvcr120.dll
C:\Users\Sedyuko\AppData\Local\Temp\sqlite3.dll
C:\Users\Sedyuko\AppData\Local\Temp\UdGq5ppxr1mJ.exe
C:\Users\Sedyuko\AppData\Local\Temp\Y1Qvh6HlfGrs.exe
Task: {5123F300-AE29-44F0-B18C-BB26B17B7676} - \Custom Language Manager -> No File <==== ATTENTION
Task: {660E7BA0-FDF6-4ED2-9D66-B9F7DA96D1E6} - \Trusted Base Helper -> No File <==== ATTENTION
Task: {8F10576D-A3E0-4872-9348-9254D1A11DEC} - \Root Language Helper -> No File <==== ATTENTION
Task: {915991E4-E96B-4FD6-9E2F-1D3A612EBDBD} - \PBot -> No File <==== ATTENTION
Task: {E646B021-9C5A-4E3F-8576-1654EAC353C9} - \Steam_x64-S-2-106-91 -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:C0E4282C [117]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:C0E4282C [117]
Reboot: