При запуске windows запускается cmd и в ie открываются левые сайты

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\users\cheat\appdata\local\hq cinema video 1.9cv23.02-browserextensionuninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10.exe');
QuarantineFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-5.exe','');
 QuarantineFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-4.exe','');
 QuarantineFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-11.exe','');
 QuarantineFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10.exe','');
 QuarantineFile('c:\users\cheat\appdata\local\hq cinema video 1.9cv23.02-browserextensionuninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10.exe','');
 DeleteFile('c:\users\cheat\appdata\local\hq cinema video 1.9cv23.02-browserextensionuninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10.exe','32');
 DeleteFile('C:\Windows\Tasks\2a738007-158e-4096-a149-812f5a56bc2f-4.job','64');
 DeleteFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10.exe','32');
 DeleteFile('C:\Windows\Tasks\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10_user.job','64');
 DeleteFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-11.exe','32');
 DeleteFile('C:\Windows\Tasks\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-11.job','64');
 DeleteFile('C:\Windows\Tasks\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-4.job','64');
 DeleteFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-4.exe','32');
 DeleteFile('C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-5.exe','32');
 DeleteFile('C:\Windows\Tasks\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-5.job','64');
 DeleteFile('C:\Windows\system32\Tasks\ca7d433d-baed-4c83-a8f9-32b3ba0c79ef-10_user','64');
 DeleteFile('C:\Windows\system32\Tasks\RegOrganizerQuickLaunch','64');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CMD');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

start
CreateRestorePoint:
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
GroupPolicyUsers\S-1-5-21-3167102569-3721641757-4175171633-1007\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-3167102569-3721641757-4175171633-1000\User: Group Policy restriction detected <======= ATTENTION
BHO-x32: No Name -> {8984B388-A5BB-4DF7-B274-77B879E179DB} ->  No File
FF Extension: No Name - C:\Users\Cheat\AppData\Roaming\Mozilla\Firefox\Profiles\izrlulxu.default\extensions\cookieimporter@krk [Not Found]
FF Extension: No Name - C:\Users\Cheat\AppData\Roaming\Mozilla\Firefox\Profiles\izrlulxu.default\extensions\6c03cee0ab9442c4a67a507@58d658df5a30468fabf5c7a.com [Not Found]
FF Extension: No Name - C:\Users\Cheat\AppData\Roaming\Mozilla\Firefox\Profiles\izrlulxu.default\extensions\389579c4-efa9-4d96-a1dd-3c86f7bd1a51@gmail.com [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [jbpkiefagocgkmemidfngdkamloieekf] - C:\Program Files (x86)\TornTV.com\torn10.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [nidmnchoekibbojpkbcojafkodobelld] - C:\Program Files (x86)\Crx\Files\nidmnchoekibbojpkbcojafkodobelld_0.1.4.crx [2013-06-29]
2015-04-17 21:06 - 2015-04-17 21:06 - 00000632 __RSH () C:\Users\Administrator\ntuser.pol
2015-04-20 07:07 - 2012-02-10 20:07 - 00005376 __RSH () C:\Users\Anat\ntuser.pol
2015-04-17 20:48 - 2013-11-25 14:38 - 00005534 __RSH () C:\Users\Cheat\ntuser.pol
C:\Users\Cheat\AppData\Local\Temp\1463.exe
C:\Users\Cheat\AppData\Local\Temp\1747.exe
C:\Users\Cheat\AppData\Local\Temp\666.exe
C:\Users\Cheat\AppData\Local\Temp\ecjcabfbcaceb.exe
AlternateDataStreams: C:\Users\Anat\Local Settings:wa
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:DESTICON_favicon1389291975
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:DESTICON_favicon1816874375
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:TASKICON_0favicon1623390499
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:TASKICON_1favicon818190576
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:TASKICON_2favicon856924206
AlternateDataStreams: C:\Users\Anat\Desktop\Shark Pro.IT (WP).website:TASKICON_3favicon-778822629
AlternateDataStreams: C:\Users\Anat\AppData\Local:wa
AlternateDataStreams: C:\Users\Anat\AppData\Local\Application Data:wa
HKU\S-1-5-21-3167102569-3721641757-4175171633-1007\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-3167102569-3721641757-4175171633-1007\Software\Classes\exefile: "%1" %* <===== ATTENTION!
Reboot:
end

start
CreateRestorePoint:
2015-04-29 14:51 - 2015-02-23 21:34 - 00000000 ____D () C:\Users\Cheat\AppData\Local\HQ Cinema Video 1.9cV23.02-BrowserExtensionUninstall
EmptyTemp:
Reboot:
end