Произвольно и регулярно устанавливаются сторонние программы, реклама в браузере

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\hnsg7a55.tmp');
 TerminateProcessByName('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\jnsb3690.tmp');
 TerminateProcessByName('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\knsufa31.tmp');
 TerminateProcessByName('c:\program files\baidu\pps.exe');
 TerminateProcessByName('c:\program files\minilite\protectservice.exe');
 TerminateProcessByName('c:\program files\sfk\sfkex.exe');
 TerminateProcessByName('c:\users\Техник\appdata\local\smartweb\smartwebapp.exe');
 TerminateProcessByName('c:\users\Техник\appdata\local\smartweb\smartwebhelper.exe');
 TerminateProcessByName('c:\program files\sfk\ssfk.exe');
 TerminateProcessByName('c:\programdata\vwdsmanprov\wdsmanpro.exe');
 SetServiceStart('WdsManPro', 4);
 SetServiceStart('SSFK', 4);
 SetServiceStart('qywymoso', 4);
 SetServiceStart('IHProtect Service', 4);
 SetServiceStart('hyverumu', 4);
 SetServiceStart('comyninu', 4);
 QuarantineFile('C:\Users\Техник\appdata\local\smartweb\__u.exe','');
 QuarantineFile('C:\Program Files\CiPlus-4.5vV29.08\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-5.exe','');
 QuarantineFile('C:\Program Files\CiPlus-4.5vV29.08\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-10.exe','');
 QuarantineFile('C:\Program Files\gmsd_ru_005010075\gmsd_ru_005010075.exe','');
 QuarantineFile('C:\Users\Техник\AppData\Local\SmartWeb\swhk.dll','');
 QuarantineFile('C:\Program Files\SFK\SFKEX.dll','');
 QuarantineFile('c:\programdata\vwdsmanprov\wdsmanpro.exe','');
 QuarantineFile('c:\program files\sfk\ssfk.exe','');
 QuarantineFile('c:\users\Техник\appdata\local\smartweb\smartwebhelper.exe','');
 QuarantineFile('c:\users\Техник\appdata\local\smartweb\smartwebapp.exe','');
 QuarantineFile('c:\program files\sfk\sfkex.exe','');
 QuarantineFile('c:\program files\minilite\protectservice.exe','');
 QuarantineFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\knsufa31.tmp','');
 QuarantineFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\jnsb3690.tmp','');
 QuarantineFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\hnsg7a55.tmp','');
 DeleteFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\hnsg7a55.tmp','32');
 DeleteFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\jnsb3690.tmp','32');
 DeleteFile('c:\program files\00000000-1439636728-0000-0000-d43d7e6b5b38\knsufa31.tmp','32');
 DeleteFile('c:\program files\baidu\pps.exe','32');
 DeleteFile('c:\program files\minilite\protectservice.exe','32');
 DeleteFile('c:\program files\sfk\sfkex.exe','32');
 DeleteFile('c:\users\Техник\appdata\local\smartweb\smartwebapp.exe','32');
 DeleteFile('c:\users\Техник\appdata\local\smartweb\smartwebhelper.exe','32');
 DeleteFile('c:\program files\sfk\ssfk.exe','32');
 DeleteFile('c:\programdata\vwdsmanprov\wdsmanpro.exe','32');
 DeleteFile('C:\Program Files\SFK\SFKEX.dll','32');
 DeleteFile('C:\Users\Техник\AppData\Local\SmartWeb\swhk.dll','32');
 DeleteFile('C:\Program Files\gmsd_ru_005010075\gmsd_ru_005010075.exe','32');
 DeleteFile('C:\Program Files\CiPlus-4.5vV29.08\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-10.exe','32');
 DeleteFile('C:\Program Files\CiPlus-4.5vV29.08\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-5.exe','32');
 DeleteFile('C:\Windows\Tasks\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-10_user.job','32');
 DeleteFile('C:\Windows\Tasks\55b46ad1-ce0d-4fc0-a7b5-375183d1e532-5_user.job','32');
 DeleteFile('C:\Windows\Tasks\ORT7DjFpRNNSXsp1pe1Kb9P6.job','32');
 DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','32');
 DeleteFile('C:\Users\Техник\AppData\Roaming\mystartsearch\UninstallManager.exe','32');
 DeleteFile('C:\Users\Техник\AppData\Roaming\istartsurf\UninstallManager.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\{03B24C23-D6EE-49B4-B7CB-BF8EE0AAD3EA}','32');
 DeleteFile('C:\Windows\system32\Tasks\{7BEF2AA0-B0C9-4D34-97E7-C59D3AB1D573}','32');
 DeleteFile('C:\Users\Техник\appdata\local\smartweb\__u.exe','32');
 DeleteService('comyninu');
 DeleteService('hyverumu');
 DeleteService('IHProtect Service');
 DeleteService('qywymoso');
 DeleteService('SSFK');
 DeleteService('WdsManPro');
 BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

Процессы: 1
RiskWare.Tool.CK, C:\Windows\KMService.exe, 1768, , [65bbe04bf893d1652084759ba2600af6]

Файлы: 127
RiskWare.Tool.CK, C:\Windows\KMService.exe, , [65bbe04bf893d1652084759ba2600af6], 
Trojan.Agent.CK, D:\ADOBE PHOTOSHOP CS2 9.0 KEYGEN\KEYGEN.EXE, , [52ce83a85635e94da4f91ffdb64c758b], 
CrackTool.Agent, D:\SV_PRO\Crack\Patch_x86\Patch_x86.exe, , [fc24f635e8a3b1854040cd247090966a],

CreateRestorePoint:
BHO: No Name -> {D5FEC983-01DB-414A-9456-AF95AC9ED7B5} ->  No File
Toolbar: HKU\S-1-5-21-3225970953-2920804203-2213259447-1000 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Техник\AppData\Roaming\o38NFVzgDx8XqSvDqSe
2015-04-19 15:20 - 2015-04-19 15:20 - 0005872 _____ () C:\Users\Техник\AppData\Roaming\ORT7DjFpRNNSXsp1pe1Kb9P6
C:\Users\Техник\AppData\Local\Temp\2Q8LUB3raCn8.exe
C:\Users\Техник\AppData\Local\Temp\3KiLeC1Fgkyd.exe
C:\Users\Техник\AppData\Local\Temp\52cyV1ro5sZw.exe
C:\Users\Техник\AppData\Local\Temp\5nRA4M7YnDnm.exe
C:\Users\Техник\AppData\Local\Temp\7IwUm38nAjmq.exe
C:\Users\Техник\AppData\Local\Temp\AmigoDistrib.exe
C:\Users\Техник\AppData\Local\Temp\DEpRYQBbYle0.exe
C:\Users\Техник\AppData\Local\Temp\dXCTdjv93b08.exe
C:\Users\Техник\AppData\Local\Temp\exdDByHdGsTB.exe
C:\Users\Техник\AppData\Local\Temp\fsd1260.exe
C:\Users\Техник\AppData\Local\Temp\fsd165D.exe
C:\Users\Техник\AppData\Local\Temp\fsd2584.exe
C:\Users\Техник\AppData\Local\Temp\fsd4DE6.exe
C:\Users\Техник\AppData\Local\Temp\fsd626A.exe
C:\Users\Техник\AppData\Local\Temp\fsd7D8C.exe
C:\Users\Техник\AppData\Local\Temp\fsd9617.exe
C:\Users\Техник\AppData\Local\Temp\GOagJw04vEY6.exe
C:\Users\Техник\AppData\Local\Temp\i4jdel0.exe
C:\Users\Техник\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe
C:\Users\Техник\AppData\Local\Temp\kbb7zb2Ne5NB.exe
C:\Users\Техник\AppData\Local\Temp\kometa_vd.exe
C:\Users\Техник\AppData\Local\Temp\mailruhomesearchvbm.exe
C:\Users\Техник\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\Техник\AppData\Local\Temp\new-super-ext.exe
C:\Users\Техник\AppData\Local\Temp\OfxbYor7RFBp.exe
C:\Users\Техник\AppData\Local\Temp\OPuPvO2TZ9xm.exe
C:\Users\Техник\AppData\Local\Temp\pps-qq-19.exe
C:\Users\Техник\AppData\Local\Temp\qqpcmgr_v10.11.16588.235_72603_Silence.exe
C:\Users\Техник\AppData\Local\Temp\QtVKBYD9ob0V.exe
C:\Users\Техник\AppData\Local\Temp\SmP7yPg1zux3.exe
C:\Users\Техник\AppData\Local\Temp\SuXXYqrdWOfT.exe
C:\Users\Техник\AppData\Local\Temp\tTWQn1825jr8.exe
C:\Users\Техник\AppData\Local\Temp\Um7gxCpnFFvu.exe
C:\Users\Техник\AppData\Local\Temp\uqcqDt81qyVT.exe
C:\Users\Техник\AppData\Local\Temp\Us3Ox5pFznrc.exe
C:\Users\Техник\AppData\Local\Temp\UybhYRrJtx6J.exe
C:\Users\Техник\AppData\Local\Temp\vuupc.exe
C:\Users\Техник\AppData\Local\Temp\wkfmmptgiw8u.exe
C:\Users\Техник\AppData\Local\Temp\Wxk9JQ6uh0jU.exe
C:\Users\Техник\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Техник\AppData\Local\Temp\XQkZJYbmWWtU.exe
C:\Users\Техник\AppData\Local\Temp\ZI9mRIzyBsAQ.exe
Task: {1931917E-931C-4344-9517-F22CD14FBDEA} - \{03B24C23-D6EE-49B4-B7CB-BF8EE0AAD3EA} -> No File <==== ATTENTION
Task: {FB2ECD35-4005-4A7B-B12C-C942D0D2FCB4} - \{7BEF2AA0-B0C9-4D34-97E7-C59D3AB1D573} -> No File <==== ATTENTION
Task: C:\Windows\Tasks\o38NFVzgDx8XqSvDqSe.job => C:\Users\������\AppData\Roaming\o38NFVzgDx8XqSvDqSe.exe <==== ATTENTION
FirewallRules: [{0AA8033D-EB21-4AEB-BBB9-143478EA1672}] => (Allow) C:\Users\Техник\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe
FirewallRules: [{A8799E4C-FBDC-46B3-A9F2-79C2911C78A9}] => (Allow) C:\Users\Техник\AppData\Roaming\IQIYI Video\LStyle\GpUpdate.exe
FirewallRules: [{378DE640-25F3-4D13-92FD-14EDD32FFC7F}] => (Allow) C:\IQIYI Video\GeePlayer\GeePlayer.exe
FirewallRules: [{4D5A35A4-6F6C-4337-BEBE-A4FF0F356AB1}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe
FirewallRules: [{D96FE8AF-3058-4EFF-BFC6-0D89ADB915FB}] => (Allow) C:\IQIYI Video\LStyle\QyWebPlayer.exe
FirewallRules: [{A1D0D32E-86FF-4C93-8C40-589DFE4E8BC6}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe
FirewallRules: [{51209906-E9BD-46AE-AB4D-5FBFE2538CE8}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe
FirewallRules: [{DEA1D30F-ED1E-4860-B546-32C90FADA789}] => (Allow) C:\Users\Техник\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe
FirewallRules: [{BBFA3BCC-5164-4086-9106-F398985B17CF}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe
FirewallRules: [{5EB9F805-F7FC-4C3C-A564-FAA12DE585CC}] => (Allow) C:\IQIYI Video\LStyle\QyWebPlayer.exe
FirewallRules: [{A53025B7-FDA2-406E-BAF8-FBB84130EA85}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe
FirewallRules: [{5D033084-7F26-483B-9870-D090715888E9}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe
FirewallRules: [{0E4EE1F1-2A60-4480-AF42-B7792521B9F1}] => (Allow) C:\Users\Техник\AppData\Roaming\IQIYI Video\GeePlayer\GpUpdate.exe
FirewallRules: [{FB7139F3-F49E-4976-9C89-835D6E4C0F16}] => (Allow) C:\IQIYI Video\GeePlayer\GeePlayer\GeePlayer.exe
Reboot: