;uVS v3.87.8 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
delall %SystemDrive%\PROGRAM FILES (X86)\WALALALA CO\AMULECUSTOM\ED2K.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\POPAPP\QUARTZMIDIMAPSCHED.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\MYGOYA\KMPFASTER\SERVICEPROVIDER.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\MYGOYA\KMPFASTER\KMPFASTER.EXE
deltmp
delnfr
restart

GroupPolicy: Restriction <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
FF Extension: (SimilarWeb) - C:\Users\Кристина\AppData\Roaming\Firefox\Firefox\Profiles\41A66E7E5EE1\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2016-10-05] [not signed]
FF Extension: (GsearchFinder) - C:\Users\Кристина\AppData\Roaming\Firefox\Firefox\Profiles\41A66E7E5EE1\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-03-01]
FF Extension: (FF Adr) - C:\Users\Кристина\AppData\Roaming\Firefox\Firefox\Profiles\41A66E7E5EE1\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2016-10-05] [not signed]
FF Extension: (Advanced SystemCare Surfing Protection) - C:\Users\Кристина\AppData\Roaming\Firefox\Firefox\Profiles\41A66E7E5EE1\Extensions\ascsurfingprotection@iobit.com [2016-09-20] [not signed]
FF Extension: (No Name) - C:\Program Files (x86)\BetterSurf\BetterSurfPlusV1\ff [not found]
FF Extension: (No Name) - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta1714\ff [not found]
FF Extension: (No Name) - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1854\ff [not found]
FF Extension: (No Name) - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha9148\ff [not found]
FF Extension: (No Name) - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha3577\ff [not found]
CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
CHR DefaultSearchURL: Default -> hxxp://www.amisites.com/search/?type=ds&ts=1479811693&z=6099462040046d3dfa1dc73gez0m1t6b6g7gaq4t9g&from=che0812&uid=HGSTXHTS545050A7E680_TMA55DTF14VNGR14VNGRX&q={searchTerms}
CHR DefaultSearchKeyword: Default -> amisites
EmptyTemp:
Reboot:

;uVS v3.87.8 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES (X86)\UNCHECKIT\CKTSVC.EXE
addsgn 1A0B739A5583008CF42B624E419C614725DF771A76EF3309C7C3AFBDF3B2CF0F23FF10523E55623C2368559A4616CAC71961AB725583E959251DA5C77E032273 8 Adware.Mutabaha.1606 [DrWeb]

zoo %SystemDrive%\PROGRAM FILES (X86)\UNCHECKIT\UNCHECKITSVC.EXE
addsgn 1A09F99A5583338CF42B627DA804DEC9E946307DDDDE13F3C9E7C13982A20E439553E75F31EFB801BFC3849E351BC2B659D3BFF929FEB8DF879CF9A493222EF2 8 Adware.Mutabaha.1606 [DrWeb]

zoo %SystemDrive%\PROGRAMDATA\CHELFNOTIFY\BROWSERUPDATE.EXE
addsgn 1A98DA9A5583338CF42BFB3A889E99F4AEC7F430CFF61FFD4CB6A3EBB808F84C239C3BDE405D161E47099214097EC0B479E4FDAE1A92B0583CD6047F8F06A734 8 Tencent

zoo %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\YANDEX\UPDATER\PRAETORIAN.EXE
addsgn 1A4B469B5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 praetotian

zoo %SystemDrive%\PROGRAM FILES\CONTENTPROTECTOR\NSS\CERTUTIL.EXE
addsgn A7679BF0AA0244B74BD4C671CC881261848AFCF689AA7BF1A0C3C5BC50559D6C704194DE5BBD1E2CD780EE9EB903DD4A3DDFB1F158F2DB6D2D882722EB6D6373 8 AdWare.Trioris.A [ESET-NOD32]

zoo %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE
addsgn 9252771A116AC1CC0B44554E33231995AF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 14 Win32:FakeSys-BF [PUP]

addsgn A7679B1928664D070E3C461264C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D2D762F906C08491649C9BD9F6307595F4659214E917F5002327C 64 Win32/Adware.ELEX

zoo %SystemDrive%\PROGRAM FILES (X86)\WINARCHER\ARCHER.DLL
addsgn A7679B1928664D070E3CABB664C8ED70357589FA768F17903B3D3A43D3127D11E11BC3A81B795F4A3B0BC96B229F44FA7DDFE82B0A85EE77A692F97E35C57217 64 Win32/Obfuscated

zoo %SystemDrive%\PROGRAMDATA\SUN\JAVA\EXTENSION.DLL
addsgn A7679B1928664D070E3C2F2664C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D8DD829906C40761649C9BD9F6307595F4659214E91F31104327C 64 Win32/Adware.ELEX

zoo %SystemDrive%\PROGRAMDATA\WINSAPSVC\WINSAP.DLL
addsgn 1AFAE19A5583378CF42BFB3A8849FE2D268AFC57A9D95A78B6064CF9AC550C44DC40B75EC12095A1B2DF849F1F95EC1A812017723F963DA9C98B5BD0AD06729B 8 BrowserModifier:Win32/Sasquor

zoo %SystemDrive%\USERS\КРИСТИНА\APPDATA\ROAMING\BFIBE\UVCONVERTER.EXE
;------------------------autoscript---------------------------

chklst
delvir

deldirex %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\SWVUPDATER

delref %SystemDrive%\PROGRAM FILES (X86)\FFGOGOGO BROWSER\BIN\BROWSERSERVER.EXE
del %SystemDrive%\PROGRAM FILES (X86)\FFGOGOGO BROWSER\BIN\BROWSERSERVER.EXE

delref {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}\[CLSID]
delref {D40C654D-7C51-4EB3-95B2-1E23905C2A2D}\[CLSID]
deldirex %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAVIEWV1\MEDIAVIEWV1ALPHA9148\CH

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAVIEWERV1\MEDIAVIEWERV1ALPHA1854\CH

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBHBLDCGBJBLIPEGBECLMCNNDDNOPNHJM%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDKEKDLKMDPIPIHONAPOLEOPFEKMAPADH%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJKFBLCBJFOJMGAGIKHLDEPPGMGDPJKPL%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLBJJFIIHGFEGNIOLCKPHPNFAOKDKBMDM%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLGDNILODCPLJOMELBBNPGDOGDBMCLBNI%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC

deldirex %SystemDrive%\PROGRAM FILES (X86)\BETTERSURF\BETTERSURFPLUSV1

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAVIEWERV1\MEDIAVIEWERV1ALPHA1854

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAVIEWV1\MEDIAVIEWV1ALPHA9148

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAVIEWV1\MEDIAVIEWV1ALPHA3577

deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAWATCHV1\MEDIAWATCHV1HOME399

delref %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.25_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\DKEKDLKMDPIPIHONAPOLEOPFEKMAPADH\1.2.9.2_0\СТАРТОВАЯ — ЯНДЕКС
deldirex %SystemDrive%\USERS\КРИСТИНА\APPDATA\LOCAL\MEDIAGET2

deldirex %SystemDrive%\PROGRAM FILES (X86)\WINZIPPER

regt 28
regt 29
deltmp
delnfr
;-------------------------------------------------------------

restart