Bubble Web (HKU\S-1-5-21-576256260-1165124755-2824884808-1001\...\{B1F22E35-A999-103B-F151-BD0FD1840634}) (Version: 1.3.0 - Extension Car corp) <==== ATTENTION
Bubble Web (HKU\S-1-5-21-576256260-1165124755-2824884808-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\{B1F22E35-A999-103B-F151-BD0FD1840634}) (Version: 1.3.0 - Extension Car corp) <==== ATTENTION
Task: {1CB2C03F-9CF3-4B12-BCBC-CC7C5BF3FC02} - \Обновление Браузера Яндекс  -> No File <==== ATTENTION
Task: {1F7B1548-EAAD-49EB-87C0-F33A00FFCBC3} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {3282A23D-272E-498C-BD85-7A0562D3F2B1} - \Bubble Web -> No File <==== ATTENTION
Task: {3523B220-BC2D-49E6-B77A-FC53612F9C42} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {45561755-0BB2-49DF-9B3C-3F0CEB4AB61E} - \Microsoft\Windows\WS\Badge Update -> No File <==== ATTENTION
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - \Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task -> No File <==== ATTENTION
Task: {7E4DC823-CB14-4E08-8155-34580C1CD749} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {7FCA7D4F-7551-44E0-B5B5-4B272E3A7F28} - \Bubble Web2 -> No File <==== ATTENTION
Task: {837BFB20-7D74-4D41-8DC1-01F9996B3386} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - \Microsoft\Windows\SkyDrive\Routine Maintenance Task -> No File <==== ATTENTION
Task: {9A7ED63E-269D-473C-A7E5-78E3B5EE47ED} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {9C8E21C9-6AB1-4D66-8DF5-73AF5359B24E} - \Microsoft\Windows\WS\Sync Licenses -> No File <==== ATTENTION
Task: {CE2DE968-E342-40D7-9566-427D45E4A886} - \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor -> No File <==== ATTENTION
Shortcut: C:\Users\Максим\Desktop\ярлыки\Google Chrome.lnk -> C:\ProgramData\EWBcQwjEH\WyaAWDMZhuYwVe0.bat ()
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-576256260-1165124755-2824884808-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Browser Manager] => C:\Users\Максим\AppData\Local\Yandex\BrowserManager\BrowserManager.exe [1427752 2015-03-23] (Yandex LLC)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-576256260-1165124755-2824884808-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-576256260-1165124755-2824884808-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-21-576256260-1165124755-2824884808-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B3C1F9C51-51BA-4917-98A3-D5BAB8314474%7D&gp=801502
CHR Extension: (No Name) - C:\Users\Максим\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpegcopcfajiiibidlaelhjjblpefbjk [2015-12-27]
CHR Extension: (No Name) - C:\Users\Максим\AppData\Local\Google\Chrome\User Data\Default\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo [2015-12-27]
CHR HKLM-x32\...\Chrome\Extension: [ablpcikjmhamjanpibkccdmpoekjigja] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cpegcopcfajiiibidlaelhjjblpefbjk] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM-x32\...\Chrome\Extension: [eioddfaepdoeifbhjphfefgipcjcdieo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gdljkkmghdkckhaogaemgbgdfophkfco] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iflppbjnpneiigcbdfjpnkebidmkjmoi] - hxxps://clients2.google.com/service/update2/crx
OPR Extension: (Quick Searcher) - C:\Users\Максим\AppData\Roaming\Opera Software\Opera Stable\Extensions\chhjbpecpncaggjpdakmflnfcopglcmi [2015-12-11]
EmptyTemp:
Reboot: 

;uVS v3.86.7 [http://dsrt.dyndns.org]
;Target OS: NTv10.0
v385c
OFFSGNSAVE
zoo %SystemDrive%\PROGRAMDATA\TMP0X0X\PROTECTWINDOWSMANAGER.EXE
addsgn 1A9D969A5583338CF42BFB3A88434711AEC7F4A00C286A75000AB0B1699B7D39022403BC10D0543D320BC193C3D63DE8F80D9D76DDCB5BC5A602B4AA317335B5 8 Adware.Downloader.BO [BitDefender]

zoo %SystemDrive%\PROGRAM FILES\CONTENT DEFENDER\CD.EXE
addsgn BA6F9BB2BD19DF720B9C2D754C211005258A303AC173435C958B4CC874CE2604A0FBF3BF2E0B9D4924377426441649FA95207A725562FD762D77ECA2FA851B88 8 Win64/Riskware.NetFilter

zoo %SystemDrive%\PROGRAM FILES (X86)\6A926AC0-1449287745-81E4-2ADA-382C4A0B1D1A\HNSW6F5F.TMP
addsgn 1ABED79A5583C58CF42B5184F0DC5005DA9F7466C8FA9AB8F1C13A6C3ACF995F7217C33D3F3F9DA1D5A5849FC5D24513BEFAE87299167CE0E1BB68E30BCAEEBF 64 Win32/Adware.ConvertAd

zoo %SystemDrive%\PROGRAM FILES (X86)\6A926AC0-1449287745-81E4-2ADA-382C4A0B1D1A\JNSJ508A.TMP
addsgn 1A93ED9A5583C58CF42BC8BE8B084356AE4B7F16867FDF0DFA48073FB2A9B0A42463F4DA9A719D492B80E29039172FF5029EF8145AA5F10C4B78DB6EF7602D0C 64 Win32/Adware.ConvertAd

zoo %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\BUBBLE WEB\{75221C21-8055-6EA3-B10B-5E0DE2112B2A}\BUBBLEWEB.DLL
addsgn 79132211B939C72F038225C4684DE452AEF7EC83807922B0F1C3D5BCBBF0F2B22263C6D4C057E86B8A18019F5693898E7488BE21AA0A35EC597BF37994EE2C8C 64 Win32/Toolbar.CrossRider

zoo %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\BUBBLE WEB\{75221C21-8055-6EA3-B10B-5E0DE2112B2A}\ANZXP.DLL
addsgn 79132211B939C72F038225C4684DE452AEF7EC8380792208C7C3D5BCBBF0F2B22263C6D4C057E86B8A50C69F5693898E7488BE21AA0A35EC597BF37994EE2C8C 64 Win32/Toolbar.CrossRider

zoo %SystemDrive%\PROGRAM FILES\CONTENT DEFENDER\CONTENTDEFENDERCONTROL.EXE
addsgn BA6F9BB2BDCD0D720B9C2D754C2124FBDA75303A4536D3B4490F09709C1ABD80EFDB0F9BF299FB2F249F009F461649FA3554293AA203F8852A77A42FB30944E3 8 Win64/Riskware.NetFilter

delref HTTP://COSMOSEARCH.RU/?RI=1&RSID=BA817F471F91FCF06943316BAB6F1679&Q={SEARCHTERMS}
delref %SystemDrive%\USERS\ЌаЪсШУ\APPDATA\LOCAL\BUBBLE WEB\COMPONENT\BUBBLE WEB
delref OBJSHELL.RUN
delall %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\TEMP\R.VBS
delref %SystemDrive%\USERS\2BA0~1\APPDATA\LOCAL\TEMP/UPDATER.EXE
;------------------------autoscript---------------------------

sreg

chklst
delvir

deldirex %SystemDrive%\PROGRAM FILES\CONTENT DEFENDER

deldirex %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

delref %Sys32%\DRIVERS\CONDEF.SYS
del %Sys32%\DRIVERS\CONDEF.SYS

delref %Sys32%\DRIVERS\CONTENTDEFENDERDRV.SYS
del %Sys32%\DRIVERS\CONTENTDEFENDERDRV.SYS

delref %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\CPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK\1.2.0.4_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EIODDFAEPDOEIFBHJPHFEFGIPCJCDIEO\5.0.1_0\ПОИСК MAIL.RU
delref NUL)&(@START\B GPUPDATE.EXE
del %SystemDrive%\PROGRAMDATA\RNQZCYX\KHLLQSXMPQ5.BAT

deldirex %SystemDrive%\USERS\МАКСИМ\APPDATA\ROAMING\ASPACKAGE

deldirex %SystemDrive%\USERS\МАКСИМ\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ASPACKAGE

del %SystemDrive%\PROGRAMDATA\BAYTL\QYVSAEPDK0.BAT

delref HTTP:\\PLARIUM.COM\PLAY\RU\SPARTA\001_TOP?ADCAMPAIGN=80404&CLICKID=TAZZTB0CYE0ATD0BTC0DTC0ATCYE0EZZ&PUBLISHERID=0_68
del %SystemDrive%\USERS\МАКСИМ\APPDATA\LOCAL\MEOFDJOP\MNPDOH1.BAT

del %SystemDrive%\PROGRAMDATA\JLSVYJSKABKYFM\KXNBHSYPP0.BAT

del %SystemDrive%\PROGRAMDATA\MVAOJXXUP\NYQXEW3.BAT

deldirex %SystemDrive%\PROGRAM FILES (X86)\GMSD_RU_005010165

regt 27
regt 28
regt 29
; AnySend
exec  C:\Users\Максим\AppData\Roaming\ASPackage\Uninstall.exe
; GamesDesktop 033.005010165
exec  C:\Program Files (x86)\gmsd_ru_005010165\unins000.exe
; SmartWeb
exec  C:\Users\Максим\AppData\Local\SmartWeb\__u.exe _?=C:\Users\Максим\AppData\Local\SmartWeb
deltmp
delnfr
areg

;-------------------------------------------------------------