;uVS v3.87.4 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
zoo %Sys32%\CPUMINER-GW64.EXE
addsgn A1BA20CF1DE77988653151F9E976C9DAC475B47B0EF6B44F853CF57B50209245D2479466E5645401A84D7B77161649FA7C049C70A6193B3265F44AD3D6DDA865 8 Win64/BitCoinMiner

zoo %SystemDrive%\USERS\ADMIN\APPDATA\ROAMING\SVCHOST.EXE
addsgn BA6F9BB2926FFE6C30D4AEB164C8FA68D184FC1E1106E08715538D3F94FEB2DC765F4AB276D679A96301681F451649B27EC82C93ACB472E8CF0ABDEF02FBF666 8 Win64/BitCoinMiner

zoo %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\SYSMENU64.DLL
addsgn BA652BBE5D22C5062FC4F9F9E724324CAE72772CC171EEFB7FC2B0B9B841EE4C235B4890B586D5C2E5C80FC36226017109FBD03AD61E9073C4D05AD038CAEEBF 64 Win32/SBWatchman.D [ESET-NOD32]

;------------------------autoscript---------------------------

hide %SystemDrive%\PROGRAM FILES (X86)\KMPLAYER\KMPLAYER.EXE
chklst
delvir

delref 1HTTP=127.0.0.1:8090
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCEGDOMHOCAEOEDBDPFOLMGJKJAIJFOMO%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCNCGOHEPIHCEKKLOKHBHIBLHFCMIPBDH%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJEDELKHANEFMCNPAPPFHACHBPNLHOMAI%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLANABBPAHPJNALJEBNPGKJEMCBKEPIAK%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLBJJFIIHGFEGNIOLCKPHPNFAOKDKBMDM%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC

deldirex %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE\1.3.25.0

delref HTTP://WWW.MYSTARTSEARCH.COM/WEB/?TYPE=DS&TS=1419616199&FROM=AMT&UID=ST2000DM001-9YN164_S2F08ANE&Q={SEARCHTERMS}
delref HTTP://WWW.MYSTARTSEARCH.COM/?TYPE=HP&TS=1419616199&FROM=AMT&UID=ST2000DM001-9YN164_S2F08ANE
delref HTTP://TUTSIFI.RU/?UTM_SOURCE=UOUA03&UTM_CONTENT=71939B02451863C8FBA27634E3B849E6&UTM_TERM=F24F2B3B6C1953E31081D1B474F03FA2&UTM_D=20160407
delref HTTP://VKPLAYERPRO.RU/INDEX.XML?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DKNEGGODALBCMGDKKFHBHBICBBAHNACJB%26INSTALLSOURCE%3DONDEMAND%26UC

deldirex %SystemDrive%\PROGRAM FILES (X86)\SHOPPERPRO\JSDRIVER\1453.0.0.0

delref %Sys32%\DRIVERS\{2FC9157E-7B3C-4EBF-95D1-57A9FDF20894}W64.SYS
del %Sys32%\DRIVERS\{2FC9157E-7B3C-4EBF-95D1-57A9FDF20894}W64.SYS

delref %Sys32%\DRIVERS\{4A917B82-B02E-49DB-87B9-93C2FBEC60D7}W64.SYS
del %Sys32%\DRIVERS\{4A917B82-B02E-49DB-87B9-93C2FBEC60D7}W64.SYS

delref %Sys32%\DRIVERS\{689B5BED-4E9B-4B8B-A673-3C39FB4D2820}GW64.SYS
del %Sys32%\DRIVERS\{689B5BED-4E9B-4B8B-A673-3C39FB4D2820}GW64.SYS

delref %Sys32%\DRIVERS\{689B5BED-4E9B-4B8B-A673-3C39FB4D2820}W64.SYS
del %Sys32%\DRIVERS\{689B5BED-4E9B-4B8B-A673-3C39FB4D2820}W64.SYS

delref %Sys32%\DRIVERS\{68F25193-AA52-462E-A675-5542F59F6112}W64.SYS
del %Sys32%\DRIVERS\{68F25193-AA52-462E-A675-5542F59F6112}W64.SYS

delref %Sys32%\DRIVERS\{9CA97048-43B1-43E4-B2CE-0F8419984BCC}W64.SYS
del %Sys32%\DRIVERS\{9CA97048-43B1-43E4-B2CE-0F8419984BCC}W64.SYS

delref %Sys32%\DRIVERS\{9F96A9B5-96A5-4002-8A88-EE75706A9E27}W64.SYS
del %Sys32%\DRIVERS\{9F96A9B5-96A5-4002-8A88-EE75706A9E27}W64.SYS

delref %Sys32%\DRIVERS\{A6994947-8316-401E-82E4-23DA215413FB}GW64.SYS
del %Sys32%\DRIVERS\{A6994947-8316-401E-82E4-23DA215413FB}GW64.SYS

delref %Sys32%\DRIVERS\{E4797980-F5F0-4BAF-88BA-DA8339F73F41}W64.SYS
del %Sys32%\DRIVERS\{E4797980-F5F0-4BAF-88BA-DA8339F73F41}W64.SYS

delref %Sys32%\DRIVERS\{E57ACCBA-821E-4DDF-AA2E-342B98125B05}W64.SYS
del %Sys32%\DRIVERS\{E57ACCBA-821E-4DDF-AA2E-342B98125B05}W64.SYS

delref %Sys32%\DRIVERS\{F40CC14B-0F67-44B4-A17E-03E43DF8E712}W64.SYS
del %Sys32%\DRIVERS\{F40CC14B-0F67-44B4-A17E-03E43DF8E712}W64.SYS

delref %SystemDrive%\USERS\GTA5.ADMIN-PC\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 2\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.2_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\GTA5.ADMIN-PC\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 2\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.2.6.0_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\GTA5.ADMIN-PC\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 2\EXTENSIONS\LANABBPAHPJNALJEBNPGKJEMCBKEPIAK\2.0.2_0\ПОИСК MAIL.RU
delref HTTP://CHATOZOV.RU/?UTM_SOURCE=UOUA03N&UTM_CONTENT=1F1A7D4E6784534601121B44B7BE8052&UTM_TERM=F24F2B3B6C1953E31081D1B474F03FA2&UTM_D=20160509
regt 27
regt 28
regt 29
deltmp
delnfr

;-------------------------------------------------------------

restart

;uVS v3.81.3 [http://dsrt.dyndns.org]
;Target OS: NTv5.1

OFFSGNSAVE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\APPLICATION DATA\YANDEX\UPDATER\PRAETORIAN.EXE
addsgn 1AD78B9A5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 praetorian

delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\GOOGLEUPDATE.EXE
delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\APPLICATION DATA\MAIL.RU\MAILRUUPDATER.EXE
delall %Sys32%\WEBALTASERVICE.EXE
delall %Sys32%\DRIVERS\SVCHOST.EXE
hide %SystemDrive%\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE

zoo %SystemRoot%\SVCHOST.COM
delall %SystemRoot%\SVCHOST.COM
EXEC cmd /c"reg add HKCR\exefile\shell\open\command /ve /d "\"%1\" %*" /f"
;------------------------autoscript---------------------------

chklst
delvir


delref HTTP://START.FUNMOODS.COM/?F=2&A=FMTGL&CHNL=FMTGL&CD=2XZUTATN2Y1L1QZUTDTDTBYETBTC0FTAYE0D0DTB0F0C0CTATN0D0TZUTBTDTCTBTDYDTBYB&CR=704762938

delref HTTP://START.FUNMOODS.COM/?F=1&A=FMTGL&CHNL=FMTGL&CD=2XZUTATN2Y1L1QZUTDTDTBYETBTC0FTAYE0D0DTB0F0C0CTATN0D0TZUTBTDTCTBTDYDTBYB&CR=704762938

regt 2
; Java(TM) 6 Update 35
exec MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216035FF} /quiet

; Ask Toolbar
exec MsiExec.exe /X{86D4B82A-ABED-442A-BE86-96357B70F4FE} /quiet

deltmp
delnfr
;-------------------------------------------------------------
czoo
restart