Не могу избавиться от вируса-майнера

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
TerminateProcessByName('c:\windows\fonts\mysql\puls.exe');
 TerminateProcessByName('c:\windows\fonts\mysql\mance.exe');
 TerminateProcessByName('c:\windows\fonts\mysql\eter.exe');
 TerminateProcessByName('c:\programdata\clr_optimization_v4.0.33018_64\svchost.exe');
 SetServiceStart('clr_optimization_v4.0.33018_64', 4);
 QuarantineFile('C:\Windows\svchost.exe','');
 QuarantineFile('C:\Windows\Fonts\Mysql\svchost.exe','');
 QuarantineFile('c:\programdata\clr_optimization_v4.0.33018_64\svchost.exe','');
 QuarantineFile('c:\windows\fonts\mysql\puls.exe','');
 QuarantineFile('c:\windows\fonts\mysql\mance.exe','');
 QuarantineFile('c:\windows\fonts\mysql\eter.exe','');
 DeleteFile('c:\windows\fonts\mysql\eter.exe','32');
 DeleteFile('c:\windows\fonts\mysql\mance.exe','32');
 DeleteFile('c:\windows\fonts\mysql\puls.exe','32');
 DeleteFile('c:\programdata\clr_optimization_v4.0.33018_64\svchost.exe','32');
 DeleteFile('C:\Windows\Fonts\Mysql\svchost.exe','64');
 DeleteFile('C:\Windows\svchost.exe','64');
 DeleteService('clr_optimization_v4.0.33018_64');
 DeleteService('RpcEpt');
 DeleteService('MicrosoftMysql');
 RegKeyDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\Eventlog\Application\NSSM','x64');
 RegKeyDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\Eventlog\Windows PowerShell\PowerShell','x64');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pvirus quarantine ./Quarantine/', 1, 0, true);
end.

Start::
CreateRestorePoint:
C:\WINDOWS\64.EXE
C:\WINDOWS\C64.EXE
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: E - E:\Start.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {0b69aa99-0fae-11e8-9267-74c63b793e74} - G:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {226fcd9a-f0c7-11e7-8b1f-74c63b793e74} - E:\Start.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {6873de86-0044-11e8-873c-74c63b793e74} - E:\Start.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {6873e00f-0044-11e8-873c-74c63b793e74} - G:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {94456cc4-330c-11e8-8cd9-74c63b793e74} - G:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {b6101975-f492-11e7-bf4a-74c63b793e74} - E:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {b6101982-f492-11e7-bf4a-74c63b793e74} - E:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {c03bb60c-4f6c-11e8-97ee-74c63b793e74} - G:\startme.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {c740da13-f0cc-11e7-b5ac-74c63b793e74} - E:\VZAccess_Manager.exe /z detect
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {fb0de352-a20f-11e8-98ae-74c63b793e74} - E:\AutoRun.exe
HKU\S-1-5-21-557406680-597626654-1843573648-1000\...\MountPoints2: {fb0de377-a20f-11e8-98ae-74c63b793e74} - E:\AutoRun.exe
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name="BVTConsumer"",Filter="__EventFilter.Name="BVTFilter"::
WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]
EmptyTemp:
Reboot:
End::

Start::
CreateRestorePoint:
Powershell: Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
Powershell: Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Powershell: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=135 name="Block_TCP-135"
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=tcp localport=445 name="Block_TCP-445"
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=udp localport=135 name="Block_UDP-135"
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=udp localport=137 name="Block_UDP-137"
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=udp localport=138 name="Block_UDP-138"
CMD: netsh advfirewall firewall add rule dir=in action=block protocol=udp localport=139 name="Block_UDP-139"
CMD: ipconfig /flushdns
CMD: wmic qfe list
EmptyTemp:
Reboot:
End::