;uVS v3.82.8 [http://dsrt.dyndns.org]
;Target OS: NTv6.2

OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES (X86)\WEBGET\BIN\WEBGET.BROWSERADAPTER.EXE
addsgn 1A69579A5583C58CF42B95BC1488530550880F3560F63E7885483AE9DB3A2CA52435C357B5AAC8C2C703688FAD1BB68F7537D65055DAE9A9ED03ABD0B20ECAB6 8 Trojan.BPlug.48 [DrWeb]

zoo %SystemDrive%\PROGRAM FILES (X86)\WEBGET\BIN\{55685567-4840-4A91-962B-49A412E9485A}.DLL
addsgn 79132211B9E9317E0AA1AB59AF4C1205DAFFF47DC4EA942D892B2942AF292811E11BC3EF69F99F598808A79B56D14C765EDBF83FF6D8A0EB28E7872BD7078171 64 Win32/BrowseFox.K [ESET-NOD32]

zoo %SystemDrive%\PROGRAM FILES (X86)\WEBGET\BIN\WEBGET.PURBROWSE64.EXE
addsgn BA6F9BB2BD393B720B9C2D754C2164FBDA75303AC173435C958B4CC074CE2404A8FB8BD4D235D5C2D1C80F460E9B043A3552FD3B50DBB06D9537A42FC7EEAC97 8 BrowseFox.A [ESET-NOD32]

zoo %SystemDrive%\USERS\USER\APPDATA\LOCAL\YANDEX\UPDATER\PRAETORIAN.EXE
addsgn 1A4B469B5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 praetorian

zoo %SystemDrive%\PROGRAM FILES (X86)\WEBGET\BIN\WEBGETBAAPP.DLL
addsgn 79132211B9E9317E0AA1AB592CBD1205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5A86CA414031E1FAD17D7B1CCF5FFB23CA00A44DC628F678B 64 Win32/BrowseFox.I [ESET-NOD32]

zoo %SystemDrive%\USERS\USER\APPDATA\LOCALLOW\YANDEX\TOOLBAR\PACKAGES\{B79038AF-919E-4D7F-8958-A3F58CE633F5}\STARDUST.DLL
addsgn A7679B1928664D070E3CF75E64C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323DE59733906C841D1649C9BD9F6307595F4659214E913BAB1A327C 11 a variant of Win32/SProtector.E

zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\1H1Q\DOWNLOAD MANAGER PACKAGES\UNINSTALLER.EXE
addsgn A7679B1991AE1F245CE76E3821389B40F9627A627605F7F5233C3A544C7F8EB3CB440AA8C1BD0780D47F6C56B4E9B6124D2B178D661AE544D1D5E42FA3F91217 19 Trojan.Packed.25266 [DrWeb]

hide %SystemDrive%\USERS\USER\APPDATA\LOCALLOW\YANDEX\TOOLBAR\PACKAGES\{B79038AF-919E-4D7F-8958-A3F58CE633F5}\STARDUST.DLL
hide %SystemDrive%\USERS\USER\APPDATA\ROAMING\1H1Q\DOWNLOAD MANAGER PACKAGES\UNINSTALLER.EXE

;------------------------autoscript---------------------------

sreg

chklst
delvir

delref %Sys32%\DRIVERS\{55685567-4840-4A91-962B-49A412E9485A}GW64.SYS
del %Sys32%\DRIVERS\{55685567-4840-4A91-962B-49A412E9485A}GW64.SYS

delref %Sys32%\DRIVERS\{55685567-4840-4A91-962B-49A412E9485A}W64.SYS
del %Sys32%\DRIVERS\{55685567-4840-4A91-962B-49A412E9485A}W64.SYS

delref %Sys32%\DRIVERS\{9EDD0EA8-2819-47C2-8320-B007D5996F8A}GW64.SYS
del %Sys32%\DRIVERS\{9EDD0EA8-2819-47C2-8320-B007D5996F8A}GW64.SYS

; webget
exec C:\Program Files (x86)\webget\webgetuninstall.exe

deldirex %SystemDrive%\PROGRAM FILES (X86)\WEBGET

deltmp
delnfr
areg

;-------------------------------------------------------------