После лечения вирус возвращается

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Users\VIta\AppData\Roaming\Microsoft\Windows\adahaggj\sthwcfrc.exe','');
 QuarantineFile('C:\Users\VIta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adahaggj.lnk','');
 DeleteFile('C:\Users\VIta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adahaggj.lnk','64');
 DeleteFile('C:\Users\VIta\AppData\Roaming\Microsoft\Windows\adahaggj\sthwcfrc.exe','64');
 DeleteSchedulerTask('Opera scheduled Autoupdate 1765637818');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pvirus quarantine ./Quarantine/', 1, 0, true);
end.

Start::
CreateRestorePoint:
HKU\S-1-5-21-1470827789-3523378260-1291882634-1000\...\Policies\Explorer: [Run] "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe"
HKU\S-1-5-21-1470827789-3523378260-1291882634-1000\...\Command Processor: "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe" <==== ATTENTION
HKU\S-1-5-21-1470827789-3523378260-1291882634-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe
HKU\S-1-5-18\...\Run: [TapiUnattend] => "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\TapiUnattend.exe"
HKU\S-1-5-18\...\Run: [vssadmin] => "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe"
HKU\S-1-5-18\...\RunOnce: [TapiUnattend] => "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\TapiUnattend.exe"
HKU\S-1-5-18\...\RunOnce: [vssadmin] => "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe"
HKU\S-1-5-18\...\Policies\Explorer: [Run] "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe"
HKU\S-1-5-18\...\Command Processor: "C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe" <==== ATTENTION
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TapiUnattend.lnk [2018-11-20]
ShortcutTarget: TapiUnattend.lnk -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\TapiUnattend.exe (No File)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vssadmin.lnk [2018-11-21]
ShortcutTarget: vssadmin.lnk -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TapiUnattend.lnk [2018-11-20]
ShortcutTarget: TapiUnattend.lnk -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\TapiUnattend.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vssadmin.lnk [2018-11-21]
ShortcutTarget: vssadmin.lnk -> C:\Users\VIta\AppData\Roaming\Microsoft\Windows\dllcache\vssadmin.exe (No File)
Reboot:
End::