;uVS v3.83 BETA 15 [http://dsrt.dyndns.org]
;Target OS: NTv6.1

OFFSGNSAVE
zoo %SystemDrive%\USERS\ЯНА\APPDATA\ROAMING\NEWNEXT.ME\NENGINE.DLL
addsgn 79132211B9E9317E0AA1AB59A52C1205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A57D0BF193CB50B67FBBABFC9ABACEB02CEA77B22FC706CA34 64 Trojan.Siggen6.685 [DrWeb]

zoo %SystemDrive%\PROGRAM FILES\TORRENTEXPRESS\TORRENTEXPRESS.EXE
addsgn 1AAF939A55835B8CF42B627DA804DEC9E946303A02B63B7C7202C6BC50D60568A91640963FD15D3D6577459C4616498F92DAE87255DA3D880977A42FC78B8657 8 a variant of Win32/ExpressDownloader.B

delall %SystemDrive%\USERS\ЯНА\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\APPLICATION\BROWSER.URL
delall %SystemDrive%\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.URL
delall %SystemDrive%\USERS\1BEE~1\APPDATA\LOCAL\TEMP\CG\RUN.EXE
delall %SystemDrive%\USERS\1BEE~1\APPDATA\LOCAL\TEMP\CP32\RUN.EXE

zoo %Sys32%\RPCSS.DLL
EXEC cmd /c "rename %sys32%\rpcss.dll rpcss.dll.old"
EXEC cmd /c "rename %sys32%\dllcache\rpcss.dll rpcss.dll.old"
EXEC cmd /c "copy rpcss.dll %sys32%\rpcss.dll"
EXEC cmd /c "copy rpcss.dll %sys32%\dllcache\rpcss.dll" 
czoo
;------------------------autoscript---------------------------

chklst
delvir

delref %SystemDrive%\PROGRAMDATA\VKSAVER\VKSAVER3.DLL

delref HTTP://SINDEX.BIZ/?COMPANY=5

delref HTTP://YAMDEX.NET/?SEARCHID=1&L10N=RU&FROMSEARCH=1&TEXT={SEARCHTERMS}

; OpenAL
exec C:\Program Files\OpenAL\OpenAL.exe" /U
deltmp
delnfr

;-------------------------------------------------------------
restart