Вирус в папке C:\Users\.\AppData\Local\Temp

begin
 TerminateProcessByName('c:\programdata\windows\chromeup.exe');
 QuarantineFile('C:\ProgramData\windows\profile\dllhostn.exe', '');
 QuarantineFile('C:\Users\zubko\AppData\Local\Temp\B5F68F2C-8F8D19EE-3A934830-9BE38F78\589c37b90d.sys', '');
 QuarantineFile('C:\Users\zubko\AppData\Local\Temp\59f5ba97cf.sys', '');
 QuarantineFile('C:\Users\zubko\AppData\Local\Temp\58a1a72d70.sys', '');
 QuarantineFile('c:\programdata\windows\chromeup.exe', '');
 DeleteFile('c:\programdata\windows\chromeup.exe', '32');
 DeleteFile('C:\ProgramData\Windows\ChromeUp.exe', '64');
 DeleteFile('C:\ProgramData\windows\profile\dllhostn.exe', '32');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 DeleteSchedulerTask('Microsoft\Windows\Active Directory Rights Management Services Client\Active Directory Rights Management Services Client');
 DeleteSchedulerTask('Microsoft\Windows\Maintenance\007');
 DeleteSchedulerTask('Microsoft\Windows\Maintenance\WinNAT');
ExecuteSysClean;
 ExecuteWizard('TSW', 2, 3, true);
RebootWindows(true);
end.

begin
 DeleteFile(GetAVZDirectory+'quarantine.7z');
 ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.