Из поисковика google перекидывает в search engine/go mail

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\Acer\AppData\Local\ComDev\ComDev.exe', '');
 QuarantineFile('C:\Users\Acer\AppData\Roaming\PBot\launchall.py', '');
 DeleteFile('C:\Users\Acer\AppData\Roaming\PBot\launchall.py', '32');
 DeleteFile('C:\WINDOWS\system32\Tasks\ComDev', '64');
 DeleteFile('C:\Program Files (x86)\IObit\Driver Booster\4.1.0\DriverBooster.exe', '32');
 DeleteFile('C:\WINDOWS\system32\Tasks\Driver Booster SkipUAC (Acer)', '64');
 DeleteFile('C:\Users\Acer\appdata\local\comdev\comdev.exe', '32');
 DelBHO('{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}');
 DelBHO('{2670000A-7350-4f3c-8081-5663EE0C6C49}');
 DeleteFileMask('C:\Users\Acer\appdata\local\comdev\', '*.*', true);
 DeleteDirectory('C:\Users\Acer\appdata\local\comdev\');
 DeleteFileMask('C:\Program Files (x86)\IObit\', '*.*', true);
 DeleteDirectory('C:\Program Files (x86)\IObit\');
 DeleteFileMask('C:\Users\Acer\AppData\Roaming\PBot\', '*.*', true);
 DeleteDirectory('C:\Users\Acer\AppData\Roaming\PBot\');
 ExecuteFile('schtasks.exe', '/delete /TN "Driver Booster SkipUAC (Acer)" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ComDev" /F', 0, 15000, true);
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'PBot');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'pizxaovyyl');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

start
CreateRestorePoint:
GroupPolicy: Restriction - Windows Defender <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
SearchScopes: HKU\S-1-5-21-756847595-2007074723-1894980057-1001 -> DefaultScope {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = 
FF Extension: (Firefox Hotfix) - C:\Users\Acer\AppData\Roaming\Mozilla\Firefox\Profiles\o57hvre5.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-11-04]
CHR HomePage: Default -> hxxp://mail.ru/cnt/10445?gp=811013
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=818404"
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
2017-01-08 19:06 - 2017-01-08 19:10 - 00000258 __RSH C:\Users\Acer\ntuser.pol
2017-01-08 18:43 - 2017-01-08 19:10 - 00000258 __RSH C:\Users\Все пользователи\ntuser.pol
2017-01-08 18:43 - 2017-01-08 19:10 - 00000258 __RSH C:\ProgramData\ntuser.pol
2017-01-08 18:43 - 2015-07-10 14:04 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
C:\Users\Acer\AppData\Local\Temp\5ZDzb56MZvyG.exe
C:\Users\Acer\AppData\Local\Temp\6MpHi0eNxYZ9.exe
C:\Users\Acer\AppData\Local\Temp\c92993cc895b608e85e8948704de4253.dll
C:\Users\Acer\AppData\Local\Temp\carambis_driver_updater_d4c7c32c72b3bc24cba0e40c93a82130c594a62b.exe
C:\Users\Acer\AppData\Local\Temp\coi1634.exe
C:\Users\Acer\AppData\Local\Temp\CqSvvVXVxXDh.exe
C:\Users\Acer\AppData\Local\Temp\ed6e8e8c4b588010c8f64663407c6196.dll
C:\Users\Acer\AppData\Local\Temp\geek64.exe
C:\Users\Acer\AppData\Local\Temp\uAgxPwCbUGDy.exe
C:\Users\Acer\AppData\Local\Temp\Uninstall.exe
C:\Users\Acer\AppData\Local\Temp\uS6iEUvrOAkX.exe
C:\Users\Acer\AppData\Local\Temp\yVfRJUaFZ9v5.exe
C:\Users\Acer\AppData\Local\Temp\{19E088AE-D289-42E3-8AC0-D312FDE2978C}-GoogleUpdateSetup.exe
Task: {FC2A1A10-233D-4880-B29F-CBB514D41623} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [346]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [346]
AlternateDataStreams: C:\Users\Все пользователи:NT [40]
AlternateDataStreams: C:\Users\Все пользователи:NT2 [346]
AlternateDataStreams: C:\Users\Acer\Application Data:NT [40]
AlternateDataStreams: C:\Users\Acer\Application Data:NT2 [346]
AlternateDataStreams: C:\Users\Acer\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\Acer\AppData\Roaming:NT2 [346]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [346]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [346]
AlternateDataStreams: C:\Users\Все пользователи\Application Data:NT [40]
AlternateDataStreams: C:\Users\Все пользователи\Application Data:NT2 [346]
AlternateDataStreams: C:\Users\Все пользователи\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\Users\Все пользователи\MTA San Andreas All:NT2 [346]

EmptyTemp:
Reboot:
end