;uVS v3.82 [http://dsrt.dyndns.org]
;Target OS: NTv6.1

OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES\TORRENTEXPRESS\TORRENTEXPRESS.EXE
addsgn 1A7EBD9A55835B8CF42BFB3A884BFE25AECFF4A0DE9017213B235BF8505B0CACD0B24A12C6DED845AE40DB1603EA178E7129E87A21DD7769D977E4B6C68B6787 8 a variant of Win32/ExpressDownloader.D

zoo %SystemDrive%\USERS\РОМЧИК\APPDATA\LOCAL\SCHEDULE\SCHEDULE.EXE
addsgn 1A11189A5583C58CF42B254E3143FE86C9AA77B381AC48128D9A7BD8959771C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 shedule

zoo %SystemDrive%\USERS\РОМЧИК\APPDATA\LOCAL\SWVUPDATER\UPDATER.EXE
addsgn 925277FA136AC1CC0B64574E334BDFFACE9A6C66196A8FE80FC583345791709756104849BDBB6158F0F26927471649FA7C049D75DEC433C2D1667F3E0707F900 8 a variant of Win32/Amonetize.I

zoo %SystemDrive%\USERS\РОМЧИК\APPDATA\ROAMING\BABSOLUTION\SHARED\BABMAINT.EXE
addsgn A7679B1BB95244720BE76ED7ED4DEAF8DA75CF3FEF7392887E3C3A8F82B0F8D9CBEE3CA8B3D065B4D47FD4F5467C499067B5E88D409E906C2DFA29D73AF9DD22 8 Adware.Babylon.12 [DrWeb]

zoo %SystemDrive%\PROGRAM FILES\DELTA\DELTA\1.8.24.6\DELTATLBR.DLL
addsgn 79132211B9E9317E0AA1AB5920981205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5A86C94C8B9635977302F00EAA3254FA7507F21D0B221CA86 64 AdWare.Win32.DelBar.a [Kaspersky]

zoo %SystemDrive%\PROGRAM FILES\DELTA\DELTA\1.8.24.6\BH\DELTA.DLL
addsgn 79132211B9E9317E0AA1AB59B4B21205DAFFF47DC4EA942D892B2942AF292811E11BC39B6BDE711E7D0BF193CD5B597100D763B3DE0BB3EA1689D227FCFE2DF1 64 AdWare.Win32.DelBar.a [Kaspersky]

zoo %SystemDrive%\USERS\РОМЧИК\APPDATA\LOCAL\YANDEX\UPDATER\PRAETORIAN.EXE
addsgn 1AF67A9B5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 praetorian

zoo %SystemDrive%\USERS\РОМЧИК\APPDATA\ROAMING\NEWNEXT.ME\NENGINE.DLL
addsgn 79132211B9E9317E0AA1AB59A52C1205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A57D0BF193CB50B67FBBABFC9ABACEB02CEA77B22FC706CA34 64 Trojan.Siggen6.685 [DrWeb]

zoo %SystemDrive%\PROGRAM FILES\DELTA\DELTA\1.8.24.6\DELTASRV.EXE
addsgn 1A2EFC9A5583C58CF42B254E3143FE86C99AAB09FCEA9235752B215CAF29FA312B923C2219BD9B5C2B80439F501649FA95F6F072555ACDD02D03A3A482FEA113 8 a variant of Win32/Toolbar.Montiera.A

zoo %SystemDrive%\PROGRAM FILES\DELTA\DELTA\1.8.24.6\DELTAENG.DLL
addsgn 79132211B9E9317E0AA1AB5912541205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5C32FDC9F46E93CEAFE1FC822AAAFBCD3587F4CCD5B0622F0 64 a variant of Win32/Toolbar.Montiera.A

zoo %SystemDrive%\PROGRAM FILES\DELTA\DELTA\1.8.24.6\DELTAAPP.DLL
addsgn 79132211B9E9317E0AA1AB59BAA91205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5A0410FD24ED1496601DCF8F95C53F828EB37AC2F9AC42A73 64 a variant of Win32/Toolbar.Montiera.A

zoo %SystemDrive%\DRIVERS\OSHOST.EXE
addsgn 1A97749A5583D38FF42B254E3143FE8E608277F608C27C0BE823B096D3AE614F563348172A68BD4CB899F08A7B374C6964ABE64F77DF23355970992F879F2306 8 Trojan.BtcMine.142 [DrWeb]

delall %SystemDrive%\PROGRAM FILES\ZAXAR\ZAXARLOADER.EXE
hide %SystemDrive%\PROGRAM FILES\TOTAL COMMANDER\UTILITES\ABURNER\GBA\GUESTBURNACCESS_2.8_AMD64.EXE
hide %SystemDrive%\PROGRAM FILES\TOTAL COMMANDER\UTILITES\ABURNER\GBA\GUESTBURNACCESS_2.8_I386.EXE
delall %SystemDrive%\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.URL
delall %SystemDrive%\USERS\РОМЧИК\APPDATA\LOCAL\PROGRAMS\OPERA\OPERA.URL
delall %SystemDrive%\USERS\РОМЧИК\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\APPLICATION\BROWSER.URL
delref HTTP://SEARCH.DOSEARCHES.COM/WEB/?UTM_SOURCE=B&UTM_MEDIUM=ILD&UTM_CAMPAIGN=RG&UTM_CONTENT=DS&FROM=ILD&UID=ST3500418AS_5VMJY8J5XXXX5VMJY8J5&TS=1384009800&TYPE=DEFAULT&Q={SEARCHTERMS}
;------------------------autoscript---------------------------

chklst
delvir


;delref %Sys32%\RPCSS.DLL

zoo %Sys32%\RPCSS.DLL
EXEC cmd /c "rename %sys32%\rpcss.dll rpcss.dll.old"
EXEC cmd /c "rename %sys32%\dllcache\rpcss.dll rpcss.dll.old"
EXEC cmd /c "copy rpcss.dll %sys32%\rpcss.dll"
EXEC cmd /c "copy rpcss.dll %sys32%\dllcache\rpcss.dll" 

delref HTTP://WWW.DELTA-SEARCH.COM/?BABSRC=NT_SS&MNTRID=C0D0002522668A53&AFFID=119776&TT=02102013_MX15RBRA&TSP=5033

delref HTTP://WWW.DOSEARCHES.COM/?UTM_SOURCE=B&UTM_MEDIUM=ILD&UTM_CAMPAIGN=RG&UTM_CONTENT=HP&FROM=ILD&UID=ST3500418AS_5VMJY8J5XXXX5VMJY8J5&TS=1384009800

delref HTTP://WEBALTA.RU/SEARCH

; Better Surf Plus
exec C:\Program Files\BetterSurf\BetterSurfPlus\uninstall.exe

; Delta toolbar  
exec C:\Program Files\Delta\delta\1.8.24.6\GUninstaller.exe" -uprtc -ask -rmbus "Delta toolbar" -nontfy -bname=dlt -key "delta

; Delta Chrome Toolbar
exec C:\Users\Ромчик\AppData\Roaming\BabSolution\Shared\GUninstaller.exe" -key "Delta Chrome Toolbar" -rmkey -rmbus "Delta Chrome Toolbar" -ask -plgdll enhancedNT -nontfy

; desktopy
exec C:\Program Files\desktopy\uninstall.exe

; desktopy.ru
exec C:\Users\Ромчик\AppData\Roaming\desktopy.ru\uninstall.exe

; Get Styles for Opera
exec C:\Program Files\Get-Styles 2.0\op\uninstall.exe

; Get-Styles for Chrome
exec C:\Program Files\Get-Styles 2.0\ch\uninstall.exe

; Get-Styles for IE
exec C:\Program Files\Get-Styles 2.0\ie\uninstall.exe

; Get-Styles для ВКонтакте
exec C:\Program Files\Get-Styles 2.0\utils\uninstall.exe

; Media Player
exec C:\Program Files\MediaPlayerV1\MediaPlayerV1alpha1600\uninstall.exe

; Media Viewer
exec C:\Program Files\MediaViewerV1\MediaViewerV1alpha1866\uninstall.exe

; Video Player
exec C:\Program Files\VideoPlayerV3\VideoPlayerV3beta493\uninstall.exe

; Zaxar Games Browser 4
exec C:\Program Files\Zaxar\unins000.exe

; Java(TM) 6 Update 27
exec MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216027FF} /quiet

exec "C:\ProgramData\BitGuard\2.7.1832.68\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\uninstall.exe" /Uninstall /{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} /um

deltmp
delnfr
;-------------------------------------------------------------

czoo

REGT 27

restart