Перекидывает на go.mail.ru после запроса в поисковике google.ru (браузеры Chrome, Opera)

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\program files (x86)\ucbrowser\application\ucbrowser.exe');
 SetServiceStart('UCBrowserSvc', 4);
 QuarantineFile('C:\Program Files (x86)\UCBrowser\Application\update_task.exe','');
 QuarantineFile('c:\program files (x86)\ucbrowser\application\ucbrowser.exe','');
 QuarantineFile('c:\program files (x86)\ucbrowser\application\6.0.1308.1003\ucagent.exe','');
 DeleteFile('c:\program files (x86)\ucbrowser\application\6.0.1308.1003\ucagent.exe','32');
 DeleteFile('c:\program files (x86)\ucbrowser\application\ucbrowser.exe','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\chrome.dll','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\chrome_child.dll','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\chrome_elf.dll','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\libegl.dll','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\libglesv2.dll','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\libmp3lame.DLL','32');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\update_task.exe','32');
 DeleteFile('C:\Windows\Tasks\UCBrowserUpdater.job','32');
 DeleteFile('C:\Windows\Tasks\UCBrowserUpdaterCore.job','32');
 DeleteFile('C:\Windows\system32\Tasks\UCBrowserUpdater','64');
 DeleteFile('C:\Windows\system32\Tasks\UCBrowserUpdaterCore','64');
 DeleteFile('C:\Program Files (x86)\UCBrowser\Application\6.0.1308.1003\Installer\chrmstp.exe','32');
 DeleteService('UCBrowserSvc');
 DelCLSID('{65122CB0-EA0F-47DF-A953-017170ED12F9}');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

CreateRestorePoint:
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay0] -> {64A9418A-B6B1-4112-B75C-E61633C9A31F} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay1] -> {6A2E142B-EA63-433A-AC05-5223CBD26E65} =>  -> No File
ShellIconOverlayIdentifiers-x32: [  MailRuCloudIconOverlay2] -> {6AFCC535-2F12-4F50-9F0A-1CF856CFC95D} =>  -> No File
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\PepperFlash\pepflashplayer.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\pdf.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll => No File
CHR Plugin: (Java Deployment Toolkit 7.0.710.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 7 U71) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-27]
CHR Extension: (Adblock Pro) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcklkibdehekfnmflempfgjhbedch [2016-05-14]
CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <not found>
CHR HKU\S-1-5-21-1686098299-2435253424-2067742885-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ilamgbdaebkbpkkmfmmfbnaamkhijdek] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [ofdgafmdegfkhfdfkmllfefmcmcjllec] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pnooffjhclkocplopffdbcdghmiffhji] - hxxps://clients2.google.com/service/update2/crx
2016-12-22 20:06 - 2016-12-22 20:06 - 00001689 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC Browser.lnk
2016-12-22 20:06 - 2016-12-22 20:06 - 00000000 ____D C:\Users\User\AppData\Local\UCBrowser
2016-12-22 20:06 - 2016-12-22 20:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC Browser
2016-12-22 20:05 - 2016-12-28 21:13 - 00000000 ____D C:\Program Files (x86)\UCBrowser
Task: {3AE2ED4C-133B-4F1D-93C4-22E78479DE8C} - \AnVir Task Manager -> No File <==== ATTENTION
Task: {76A4C035-786A-4CA6-8D8F-00F8ECDB77E3} - System32\Tasks\DelayedItemsByChemtableSoftware\GoogleDriveSync => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2016-11-30] (Google) <==== ATTENTION
AlternateDataStreams: C:\Windows:nlsPreferences [0]
Reboot:

CreateRestorePoint:
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
Reboot: