[решено] Автоматически открывется браузер с разными рекламными страницами

Сначала нужно удалить mystartsearch

для этого выполните

Панель управления\Программы и компоненты" удалить
mystartsearch
WindowsMangerProtect
xtab,
HDQ-1.2cV06

После этого

• Скрипт AVZ.
Выполните скрипт AVZ. Меню Файл - Выполнить скрипт, вставляем написаный скрипт - кнопка Запустить, после выполнения компьютер перезагрузится.

Код:

begin

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe  /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-7.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-6.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-5.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-4.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-3.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-11.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\HDQ-1.2cV06.01-codedownloader.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe','');

 QuarantineFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','');

 QuarantineFile('C:\ProgramData\WindowsMangerPro','');

 QuarantineFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe','');

 QuarantineFile('C:\Program Files (x86)\XTab\ProtectService.exe','');

 SetServiceStart('ccnfd_1_10_0_5', 4);

 DeleteService('ccnfd_1_10_0_5');

 StopService('ccnfd_1_10_0_5');

 SetServiceStart('WindowsMangerProtect', 4);

 DeleteService('WindowsMangerProtect');

 StopService('WindowsMangerProtect');

 SetServiceStart('IHProtect Service', 4);

 DeleteService('IHProtect Service');

 StopService('IHProtect Service');

 QuarantineFile('C:\Windows\system32\drivers\ccnfd_1_10_0_5.sys','');

 QuarantineFile('C:\Program Files (x86)\XTab\IeWatchDog.dll','');

 QuarantineFile('C:\Program Files (x86)\XTab\BrowserAction.dll','');

 QuarantineFile('C:\Program Files (x86)\XTab\BrowerWatchFF.dll','');

 QuarantineFile('C:\Program Files (x86)\XTab\BrowerWatchCH.dll','');

 TerminateProcessByName('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe');

 QuarantineFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','');

 TerminateProcessByName('c:\program files (x86)\xtab\protectservice.exe');

 QuarantineFile('c:\program files (x86)\xtab\protectservice.exe','');

 TerminateProcessByName('c:\program files (x86)\xtab\hpnotify.exe');

 TerminateProcessByName('c:\program files (x86)\xtab\cmdshell.exe');

 QuarantineFile('c:\program files (x86)\xtab\hpnotify.exe','');

 QuarantineFile('c:\program files (x86)\xtab\cmdshell.exe','');

 DeleteFile('c:\program files (x86)\xtab\cmdshell.exe','32');

 DeleteFile('c:\program files (x86)\xtab\hpnotify.exe','32');

 DeleteFile('c:\program files (x86)\xtab\protectservice.exe','32');

 DeleteFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe','32');

 DeleteFile('C:\Program Files (x86)\XTab\BrowerWatchCH.dll','32');

 DeleteFile('C:\Program Files (x86)\XTab\BrowerWatchFF.dll','32');

 DeleteFile('C:\Program Files (x86)\XTab\BrowserAction.dll','32');

 DeleteFile('C:\Program Files (x86)\XTab\IeWatchDog.dll','32');

 DeleteFile('C:\Windows\system32\drivers\ccnfd_1_10_0_5.sys','32');

 DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe','32');

 DeleteFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe','32');

 DeleteFile('C:\ProgramData\WindowsMangerPro','32');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','32');

 DeleteFile('C:\Windows\Tasks\2aa9331d-9811-46ea-854e-72cc44b9c10c.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe','32');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\HDQ-1.2cV06.01-codedownloader.exe','32');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-1.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-11.exe','32');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-3.exe','32');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-4.exe','32');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-5.exe','32');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-11.job','64');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-3.job','64');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-4.job','64');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5.job','64');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5_user.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-6.exe','32');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-6.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\466504a8-02e2-4793-b01b-cbcefb317163-7.exe','32');

 DeleteFile('C:\Windows\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-7.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.exe','32');

 DeleteFile('C:\Windows\Tasks\48a7cd0b-d562-48e1-9274-bef5b8fd70dd.job','64');

 DeleteFile('C:\Program Files (x86)\HDQ-1.2cV06.01\2aa9331d-9811-46ea-854e-72cc44b9c10c.exe  /agentregpath=HDQ-1.2cV06.01 /appid=69063 /srcid=002413 /subid=0 /zdata=0 /bic=D05A8F8AC4474A10B0359A5FA3CAB5BEIE /verifier=e92354e5f893468fede0d944ecdf8311 /installerversion=1_35_12_18 /installationtime=1420550618 /statsdomain=http://stats.newstatsdemosrv.com /errorsdomain=http://errors.newstatsdemosrv.com /extensionname=Information /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,178-288,179-288,180-288,223-288,263-24 /monetizationdomain=http://logs.newstatsdemosrv.com /runfrom=task /externallog=','32');

 DeleteFile('C:\Windows\system32\Tasks\2aa9331d-9811-46ea-854e-72cc44b9c10c','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-1','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-11','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-3','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-4','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-5','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-6','64');

 DeleteFile('C:\Windows\system32\Tasks\466504a8-02e2-4793-b01b-cbcefb317163-7','64');

BC_ImportAll;

ExecuteSysClean;

ExecuteWizard('TSW',2,3,true);

BC_Activate;

RebootWindows(true);

end.

После всех процедур выполните скрипт

Код:

begin

 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');

end.