Вирус yamdex

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Program Files (x86)\baidu\baidu.exe', '');
 QuarantineFile('C:\Program Files (x86)\Zaxar\timetasks.exe', '');
 QuarantineFile('C:\PROGRAM FILES (X86)\GOOGLE\СHRОMЕ.BАT.EXE', '');
 DeleteFile('C:\PROGRAM FILES (X86)\GOOGLE\СHRОMЕ.BАT.EXE', '32');
 DeleteFile('C:\Program Files (x86)\Zaxar\timetasks.exe', '32');
 DeleteFile('C:\Program Files (x86)\Google\chrome.bat', '32');
 DeleteFile('C:\IЕХPLОRЕ.BАT.EXE', '32');
 DeleteFile('C:\Program Files (x86)\baidu\baidu.exe', '32');
 DeleteFileMask('C:\Program Files (x86)\baidu\', '*', true);
 DeleteDirectory('C:\Program Files (x86)\baidu\');
 DeleteFileMask('C:\Program Files (x86)\Zaxar\', '*', true);
 DeleteDirectory('C:\Program Files (x86)\Zaxar\');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Timestasks', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\baidu', 'command');
BC_ImportAll;
 ExecuteWizard('SCU', 2, 3, true);
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

C:\Users\Alexei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехplоrеr.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnеt Ехplоrеr (Nо Аdd-оns).lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Ехplоrеr.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\b6685dc9715a7155\Gооglе Сhrоmе.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Gооglе Сhrоmе.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrоmе.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Gооglе Сhrоmе.lnk
C:\Users\Alexei\AppData\Roaming\Microsoft\Windows\SendTo\МойМир@Mail.ru.lnk

start
HKU\S-1-5-21-2680549480-4240543542-3731331864-1000\...\Run: [amigo] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2680549480-4240543542-3731331864-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
URLSearchHook: [S-1-5-21-2680549480-4240543542-3731331864-1000] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-2680549480-4240543542-3731331864-1000 - (No Name) - {0633EE93-D776-472f-A0FF-E1416B8B2E3D} - No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2680549480-4240543542-3731331864-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = 
SearchScopes: HKU\S-1-5-21-2680549480-4240543542-3731331864-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3D} URL = 
Toolbar: HKU\S-1-5-21-2680549480-4240543542-3731331864-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKU\S-1-5-21-2680549480-4240543542-3731331864-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
FF Plugin HKU\S-1-5-21-2680549480-4240543542-3731331864-1000: @mail.ru/GameCenter -> C:\Users\Alexei\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll No File
CHR HKLM\...\Chrome\Extension: [aaaaaejaghnbcjilindpkgmcmdflpgjf] - No Path
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [aaaaaejaghnbcjilindpkgmcmdflpgjf] - No Path
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [floliaooiknlkomgicdodamdihnhjgni] - No Path
CHR HKLM-x32\...\Chrome\Extension: [gdknicmnhbaajdglbinpahhapghpakch] - No Path
CHR HKLM-x32\...\Chrome\Extension: [jedelkhanefmcnpappfhachbpnlhomai] - No Path
CHR HKLM-x32\...\Chrome\Extension: [lejgaailkdamkibfiedjjnejcibjgljl] - No Path
CHR HKLM-x32\...\Chrome\Extension: [nldekieodmkceimbjnaboonipiaakoel] - No Path
CHR HKLM-x32\...\Chrome\Extension: [nphbmanpfjfdngbaamhajooihmjacmfe] - No Path
CHR HKLM-x32\...\Chrome\Extension: [pganlglbhgfjfgopijbhemcpbehjnpia] - No Path
2014-10-24 01:14 - 2014-10-24 01:14 - 0000040 _____ () C:\Program Files\{AACE8122-B27D-421C-A5BB-95060941AFD7}.sys
MSCONFIG\startupreg: baidu => 
EmptyTemp:
Reboot:
end