Task: {7ADADF9B-C16F-466D-8A53-378F057A4706} - System32\Tasks\Microsoft\Windows\Maintenance\WinDAT => cmd /c dlchosts.exe || dlhosts.exe
AlternateDataStreams: C:\ProgramData\TEMP:07BF512B [314]
AlternateDataStreams: C:\Users\Все пользователи\TEMP:07BF512B [314]
IE trusted site: HKU\S-1-5-21-3703536830-2517312684-67817336-1002\...\hola.org -> hxxp://hola.org
BootExecute: autocheck autochk * avgBoot.exe /M:301c25ceb /wow /dir:"C:\peka protekt other\AVG"
FF NewTab: Mozilla\Firefox\Profiles\age9z06f.default -> about:newtab
FF Extension: (Avast Passwords) - C:\Users\Legend\AppData\Roaming\Mozilla\Firefox\Profiles\age9z06f.default\Extensions\jid1-r1tDuNiNb4SEww@jetpack.xpi [2019-01-12] [UpdateUrl:hxxps://pamcdn.avast.com/pamcdn/extensions/firefox/update.json]
FF Extension: (Avast Online Security) - C:\Users\Legend\AppData\Roaming\Mozilla\Firefox\Profiles\age9z06f.default\Extensions\wrc@avast.com.xpi [2019-01-29]
2019-03-28 15:03 - 2019-03-28 15:03 - 000231544 _____ (AVAST Software) C:\Users\Legend\Downloads\avast_free_antivirus_setup_online.exe
2019-03-28 13:51 - 2019-03-28 13:51 - 000000000 ____D C:\Users\Все пользователи\Doctor Web
2019-03-28 13:51 - 2019-03-28 13:51 - 000000000 ____D C:\ProgramData\Doctor Web
2019-03-28 14:50 - 2017-04-10 16:31 - 000000000 ____D C:\Users\Legend\Doctor Web


EmptyTemp:
Reboot:

;uVS v4.1.3 [http://dsrt.dyndns.org]
;Target OS: NTv6.3
v400c
OFFSGNSAVE
deltmp
delref DLHOSTS.EXE
delref AVGBOOT.EXE
delref %SystemDrive%\PROGRAM
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref %Sys32%\BLANK.HTM
delref %SystemDrive%\VG\DONT STARVE\SMARTSTEAMLOADER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\DRIVER BOOSTER\4.5.0\UNINS000.EXE
delall %SystemDrive%\VG\DONT STARVE\BIN\TSS_SDK.DLL
deldir %SystemDrive%\PROGRAM FILES\UNITY\WEBPLAYER64\LOADER-X64
regt 30
restart
;---------command-block---------
delref DLCHOSTS.EXE
apply