В браузерах при нажатии на ссылки/на любое место на странице открывается окно с рекламой/каким-то сайтом

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Windows\system32\ihctrl32.dll','');
 QuarantineFile('C:\Program Files (x86)\Gronuchcoaregh\bemition.exe','');
 QuarantineFile('C:\ProgramData\ChelfNotify\BrowserUpdate.exe','');
 DeleteFile('C:\ProgramData\ChelfNotify\BrowserUpdate.exe','32');
 DeleteFile('C:\Program Files (x86)\filter\2\CppWindowsService.exe','32');
 DeleteFile('C:\Program Files (x86)\Gronuchcoaregh\kaeentthohodomCln.dll','32');
 DeleteFile('C:\Windows\System32\ihctrl32.dll','32');
 DeleteFile('C:\ProgramData\Tencent\QQ\report\Reporter.dll','32');
 DeleteFile('C:\Users\User\AppData\Local\Amigo\Application\amigo.exe','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_5\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\LocalLow\Youtube AdBlock\local64spl.dll','32');
 DeleteFile('C:\Program Files (x86)\Youtube AdBlock_\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_3_\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_3\local64spl.dll','32');
 DeleteFile('C:\Program Files (x86)\Youtube AdBlock\local64spl.dll','32');
 DeleteFile('C:\Windows\Temp\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_6_\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_6\local64spl.dll','32');
 DeleteFile('C:\Windows\Temp_\local64spl.dll','32');
 DeleteFile('C:\_\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\LocalLow\Youtube AdBlock_\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\Local\Temp_\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\Local\Temp\local64spl.dll','32');
 DeleteFile('C:\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_5_\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\Local\Google\Chrome\User Data_\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_4_\local64spl.dll','32');
 DeleteFile('C:\Users\User\AppData\Local\Google\Chrome\User Data\local64spl.dll','32');
 DeleteFile('D:\Program Files\MSUser.Default\Help_4\local64spl.dll','32');
 DeleteFile('C:\Windows\system32\Tasks\Auslogics\BoostSpeed\Start BoostSpeed оn User logon','64');
 DeleteFile('C:\Windows\system32\Tasks\Auslogics\Driver Updater\Scan','64');
 DeleteFile('C:\Windows\system32\Tasks\GlaryInitialize 5','64');
 DeleteFile('C:\Windows\system32\Tasks\GU5SkipUAC','64');
 DeleteFile('C:\Windows\system32\Tasks\InternetC','64');
 DeleteFile('C:\Program Files (x86)\Gronuchcoaregh\bemition.exe','32');
 ExecuteFile('schtasks.exe', '/delete /TN "Anofotion Collector" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Scan and Repair" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "InternetC" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "GU5SkipUAC" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "GlaryInitialize" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Scan" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "ChelfNotify Task" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Start BoostSpeed оn User logon" /F', 0, 15000, true);
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\ihctrl32\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\IlS\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\amigo','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\AnofotionCollector\Parameters','ServiceDll');
 DeleteService('CppWindowsService');
 DelBHO('{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}');
 DelBHO('{2670000A-7350-4f3c-8081-5663EE0C6C49}');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.