CHR Extension: (WhatsWeb) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cebcbiddpikadcfodbjihffmddoohdma [2015-04-05]
CHR Extension: (AdBlock) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-14]
DefaultPrefix-x32: => http://yamdex.net/?searchid=1&l10n=ru&fromsearch=1&imsid=825324a2ba82845128eb92f2d5b7ef67&text= <==== ATTENTION
CHR Extension: (HTML5 location provider) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nhgcieglcpdegkhamigiokdphfhhnlhh [2012-08-03]
CHR Extension: (CinemaPlus-3.2cV06.07) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-07-07]
CHR Extension: (Please enter your password) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2015-04-02]
CHR Extension: (Angry Birds) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2015-04-02]
CHR Extension: (HTML5 location provider) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\nhgcieglcpdegkhamigiokdphfhhnlhh [2015-04-02]
CHR Extension: (CinemaPlus-3.2cV06.07) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-07-07]
CHR Extension: (Amazon 1Button App for Chrome) - C:\Users\АДМИН\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2015-04-02]
CHR HKU\S-1-5-21-970964006-845550971-1886412459-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\0A6A~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [Not Found]
EmptyTemp:
Reboot:

;uVS v3.85.25 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES (X86)\CINEMAPLUS-3.2CV06.07\D131932D-2BFB-4F57-94FC-116F683BACAE-3.EXE
addsgn 1AB2939A5583338CF42BFB3A889E99702D0F0A8E80128E9D85C3FE8C2CD199C4C617C3DC0EBDE6AC2B800F9BF648143928540424BD1AF32C2DFC54AA317325CB 8 Trojan.Crossrider

zoo %SystemDrive%\USERS\АДМИН\DESKTOP\ТОЙОТА\PLAYER.EXE
addsgn 6E8C9F98556A4C41CB5F6A32A4CC818EC601A70A08111858C5C34261D36B4C656317C258BA6699492B0039CD695649FA09E865F7AEF6F02C7D8831F8EB4622FE 24 svghost

zoo %SystemDrive%\USERS\АДМИН\APPDATA\LOCAL\386ECC81-1436278116-11CB-8B3E-DA59DE49C098\BNSW80D9.EXE
addsgn 1A6FDE9A5583C58CF42B254E3143FE86C9AA77B381AC48128D9A7B44D89271C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 Adware.ConvertAd

zoo %SystemDrive%\USERS\АДМИН\APPDATA\ROAMING\VOPACKAGE\VOPACKAGE.EXE
addsgn 7300F79B556A1F275DE775E6ED94361DE2CED8E6E96B5F78B63503F874C251B33627B3173E3D9CC92B807B8AF66609FA2E20FD0E279AB04625D4BCC38506CA82 64 Adware.ConvertAd

addsgn 1ABF639B5583C58CF42B254E3143FE6F2FE0FC09FCF2F77B92C2C53F94DA2C8FA8E896DCD2AAE845418AEE9FB963411268C8E972D61EA071EEFC5B7A4CEA7F9A 8 Amonetize

zoo %SystemDrive%\USERS\АДМИН\APPDATA\LOCAL\29527\UPDATER.EXE
hide %SystemDrive%\USERS\АДМИН\APPDATA\LOCAL\DROPBOX\UPDATE\DROPBOXUPDATE.EXE
hide %SystemDrive%\PROGRAM FILES\LENOVO\COMMUNICATIONS UTILITY\TPKNRSVC.EXE
;------------------------autoscript---------------------------

chklst
delvir

deldirex %SystemDrive%\PROGRAM FILES (X86)\ANYPROTECTEX

deldirex %SystemDrive%\PROGRAM FILES (X86)\CROSSBROWSE\CROSSBROWSE\APPLICATION

deldirex %SystemDrive%\PROGRAM FILES (X86)\GLOBALUPDATE\UPDATE

delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\GOOGLEUPDATE.EXE

delref %SystemDrive%\USERS\�����\APPDATA\ROAMING\QZDGUDMYUBELHLTYRKBI4F.EXE

delref %SystemDrive%\USERS\АДМИН\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 3\EXTENSIONS\PAPBADOLDDDALGCJCICNIKCFENODPGHP\1.26.88_0\CINEMAPLUS-3.2CV06.07

delref %SystemDrive%\USERS\АДМИН\APPDATA\LOCAL\YANDEX\UPDATER\PRAETORIAN.EXE

; CinemaPlus-3.2cV06.07
exec  C:\Program Files (x86)\CinemaPlus-3.2cV06.07\Uninstall.exe /fcp=1 /runexe='C:\Program Files (x86)\CinemaPlus-3.2cV06.07\UninstallBrw.exe' /url='http://notif.keyprobox.com/notf_sys/index.html' /brwtype='uni' /onerrorexe='C:\Program Files (x86)\CinemaPlus-3.2cV06.07\utils.exe' /crregname='CinemaPlus-3.2cV06.07' /appid='72893' /srcid='002974' /bic='907e95f846ea368b8c89d9a90425bf52IE' /verifier='9d62fd073cdcb48724936a09665a08c5' /brwshtoms='15000' /installerversion='1_36_01_22' /statsdomain='http://stats.keyprobox.com/utility.gif?' /errorsdomain='http://errors.keyprobox.com/utility.gif?' /monetizationdomain='http://logs.keyprobox.com/monetization.gif?'
; Crossbrowse
exec  C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\setup.exe" --uninstall --system-level
; Remote Desktop Access (VuuPC)
exec  C:\Users\АДМИН\AppData\Roaming\VOPackage\Uninstall.exe

deldirex %SystemDrive%\PROGRAM FILES (X86)\CINEMAPLUS-3.2CV06.07

deltmp
delnfr
;-------------------------------------------------------------

restart