Startup_urls Самопроизвольное открытие рекламных вкладок в браузерах и сайта updater-discounter.com

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 TerminateProcessByName('c:\program files\ultimate-discounter browser\udservice.exe');
 TerminateProcessByName('c:\users\d899~1\appdata\roaming\setupsk\python\pythonw.exe');
 QuarantineFile('C:\Users\Сергей\AppData\Local\wutphost\wutphost.exe', '');
 QuarantineFile('C:\Users\Сергей\AppData\Local\wupdate\wupdate.exe', '');
 QuarantineFile('C:\Users\D899~1\AppData\Roaming\setupsk\ml.py', '');
 QuarantineFile('C:\Users\D899~1\AppData\Roaming\setupsk\python\DLLs\_ctypes.pyd', '');
 QuarantineFile('c:\program files\ultimate-discounter browser\udservice.exe', '');
 QuarantineFile('c:\users\d899~1\appdata\roaming\setupsk\python\pythonw.exe', '');
 DeleteFile('c:\program files\ultimate-discounter browser\udservice.exe', '32');
 DeleteFile('C:\Users\D899~1\AppData\Roaming\setupsk\python\DLLs\_ctypes.pyd', '32');
 DeleteFile('C:\Users\D899~1\AppData\Roaming\setupsk\python\pythonw.exe', '32');
 DeleteFile('C:\Users\D899~1\AppData\Roaming\setupsk\ml.py', '32');
 DeleteFile('C:\Windows\system32\Tasks\Driver Booster SkipUAC (Сергей)', '32');
 DeleteFile('C:\Users\D899~1\AppData\Roaming\setupsk\app.py', '32');
 DeleteFile('C:\Users\Сергей\AppData\Local\wupdate\wupdate.exe', '32');
 DeleteFile('C:\Users\Сергей\AppData\Local\wutphost\wutphost.exe', '32');
 DeleteFile('C:\Windows\system32\Tasks\setupsk', '32');
 DeleteFile('C:\Windows\system32\Tasks\setupsk2', '32');
 DeleteFile('C:\Windows\system32\Tasks\wupdate', '32');
 DeleteFile('C:\Windows\system32\Tasks\wutphost', '32');
 ExecuteFile('schtasks.exe', '/delete /TN "setupsk" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "setupsk2" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "wupdate" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "wutphost" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "Driver Booster SkipUAC (Сергей)" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "newshistoryorgzsofsm" /F', 0, 15000, true);
 DeleteService('WinRing0_1_2_0');
 DeleteService('Coupons Browser Update Service');
 DelBHO('{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}');
 DelBHO('{2670000A-7350-4f3c-8081-5663EE0C6C49}');
 DelCLSID('{189F1E63-33A7-404B-B2F6-8C76A452CC54}');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'setupsk');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'adjkaqizxe');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive('c:\quarantine.zip');
end.