Рекламное ПО в браузере

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 TerminateProcessByName('c:\users\user\appdata\local\yc\application\yc.exe');
 TerminateProcessByName('C:\Windows\System32\AppFrameHost.exe');
 SetServiceStart('AppFrameHost', 4);
 StopService('AppFrameHost');
 QuarantineFile('C:\Users\user\appdata\roaming\system\libs\svchost.exe','');
 QuarantineFile('C:\WINDOWS\microsoft\svchost.exe.exe','');
 QuarantineFile('C:\Users\user\AppData\Local\yc\Application\yc.exe','');
 QuarantineFile('C:\Windows\System32\AppFrameHost.exe','');
 QuarantineFileF('c:\users\user\appdata\local\yc', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('C:\WINDOWS\microsoft', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 QuarantineFileF('C:\Users\user\appdata\roaming\system', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 ,0);
 DeleteFile('C:\Windows\System32\AppFrameHost.exe','32');
 DeleteFile('C:\Users\user\AppData\Local\yc\Application\yc.exe','32');
 DeleteFile('C:\WINDOWS\microsoft\svchost.exe.exe','32');
 DeleteFile('C:\Users\user\appdata\roaming\system\libs\svchost.exe','32');
 DeleteService('AppFrameHost');
 DeleteFileMask('c:\users\user\appdata\local\yc','*', true);
 DeleteFileMask('C:\WINDOWS\microsoft','*', true);
 DeleteFileMask('C:\Users\user\appdata\roaming\system','*', true);
 DeleteDirectory('c:\users\user\appdata\local\yc');
 DeleteDirectory('C:\WINDOWS\microsoft');
 DeleteDirectory('C:\Users\user\appdata\roaming\system');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ycAutoLaunch_87B41A820EE972244660D9B310E9350D');
ExecuteSysClean;
 ExecuteWizard('SCU', 2, 3, true);
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 RebootWindows(true);
end.

O9-32 - Extra button: (no name) - HKLM\..\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - (no file)
O17 - HKLM\System\CSS\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 81.171.10.42
O17 - HKLM\System\CSS\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 82.202.226.203
O17 - HKLM\System\CSS\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 94.130.44.229
O17 - HKLM\System\ControlSet001\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 81.171.10.42
O17 - HKLM\System\ControlSet001\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 82.202.226.203
O17 - HKLM\System\ControlSet001\Services\Tcpip\..\{3ac15406-7a68-4fd6-9874-1fbd84e06d27}: NameServer = 94.130.44.229

Start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2605055683-1508232814-3397307059-1000\...\MountPoints2: {9ed8fe15-0ae8-11e6-9569-806e6f6e6963} - "E:\AutoRun.exe" 
GroupPolicy: Restriction <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\2fkb7pob.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\2fkb7pob.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\2fkb7pob.default -> hxxp://mail.ru/cnt/10445?gp=811040
FF Extension: (No Name) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2fkb7pob.default\extensions\{3B4DE07A-DE43-4DBC-873F-05835FF67DCE} [not found]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
OPR Extension: (No Name) - C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Extensions\ahggfmgiidlaceichjfemgbaggnbaloe [2017-07-15]
OPR Extension: (Teddy Protection Lite) - C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Extensions\nojkagbjbhgnilkopgljfkhddmdjcjfn [2017-02-16]
2017-07-15 17:49 - 2017-07-15 17:49 - 00000000 ____D C:\Users\user\AppData\Local\Войны престолов
2017-07-15 17:45 - 2017-07-15 17:45 - 00920784 _____ C:\WINDOWS\system32\AppFrameHost.exe
2017-07-15 17:41 - 2017-07-15 19:23 - 00000000 ____D C:\Users\user\AppData\Local\wmipr
2017-07-15 17:35 - 2017-07-15 17:35 - 00000000 ____D C:\Users\user\AppData\Roaming\curl
C:\WINDOWS\Microsoft
ContextMenuHandlers01: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File
ContextMenuHandlers04: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File
ContextMenuHandlers05: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} =>  -> No File
ContextMenuHandlers06: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} =>  -> No File
Task: {06A498B3-630B-432E-A0F1-0CF0E05B2CA1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {27E45FC7-988E-41C7-BCE6-2F78D104BB1F} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {4EF2415F-904F-49D2-9FF6-702349460E67} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {52BD7721-83C0-44DC-A91E-0474470A5ADC} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {7FC37502-302F-4AA4-91AA-557D613872F9} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {885BA7ED-C373-402F-AB8E-135180C6B9AC} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {8AF3F348-7266-4BAA-A9F8-ADD5DD4887CA} - \Lenovo\Lenovo Service Bridge\S-1-5-21-2605055683-1508232814-3397307059-1000 -> No File <==== ATTENTION
Task: {8C87CA5D-4C6C-485F-9743-26DAA0A777E7} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8D99CF43-DD75-4301-8864-66C311B8BBF2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {A227D8D1-A2F9-40EB-8C01-4D7B62E56892} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {A272D8F4-3D6B-4126-920E-01436BCE57CD} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {B3BBE27B-CF1E-4467-8849-4FA2B4FA02C3} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {D4653703-B86B-4C6A-BA82-88220B0600BA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {DB913C4D-77D7-4C33-A99E-6F11160106A4} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {E7E31048-D01B-4135-A943-3F4F97AA2388} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
FirewallRules: [{7E6E62D9-0507-4E96-9E1B-B9FCD33C47D3}] => (Allow) C:\Program Files\UBar\ubar.exe
FirewallRules: [{2BF63D41-C01B-4024-A7D7-707235BCA287}] => (Allow) C:\Users\user\AppData\Local\Amigo\Application\amigo.exe
FirewallRules: [{69BEDC3A-0F7D-4536-BB78-C9490E0C3C9C}] => (Allow) C:\Users\user\AppData\Local\yc\Application\yc.exe
EmptyTemp:
Reboot:
end