;uVS v4.13 [http://dsrt.dyndns.org:8888]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

delall %SystemDrive%\USERS\DMITRIY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\H34567Q4.DEFAULT-RELEASE\EXTENSIONS\HELPER@SAVEFROM.NET.XPI
delref HTTP://WWW.BING.COM/SEARCH?Q={SEARCHTERMS}&SRC=IE-SEARCHBOX&FORM=IESR02
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAEGNOPEGBBHJEEIGANIAJFFNALHLKKJB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DIBKNAFOBNMNDICOJAHLPPOLCAAIBNGJF%26INSTALLSOURCE%3DONDEMAND%26UC
apply

regt 27
regt 28
regt 29
deltmp
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE15\OLICENSEHEARTBEAT.EXE
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref %SystemRoot%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID]
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref %SystemDrive%\SOFT\IGAMES\WARCRAFT 3 - REIGN OF CHAOS\BLIZZARD.AX
delref %Sys32%\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\MSCORSEC.DLL
delref %Sys32%\PWCREATOR.EXE
delref %SystemDrive%\PROGRAM FILES\INTEL\THUNDERBOLT SOFTWARE\TBTSVC.EXE
delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\CHECKPOINT\ENDPOINT SECURITY\SANDBLAST\SANDBLAST.XPI
delref %SystemDrive%\PROGRAM FILES\MICROSOFT ONEDRIVE\STANDALONEUPDATER\ONEDRIVESETUP.EXE
delref %SystemDrive%\PROGRAM FILES\PROXY LABS\PROXYCAP\PCAPUI.EXE
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref %Sys32%\BLANK.HTM
delref %SystemDrive%\PROGRAM FILES (X86)\CHECKPOINT\ENDPOINT SECURITY\ANTI-MALWARE\EP_SHELLEXT.DLL
delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS
delref H:\_AUTORUN\AUTORUN.EXE
delref {424BE3CD-34AB-4F51-9C57-4341166DC8FA}\[CLSID]
delref {611B6CB4-ACE6-4655-8D60-15FAC4AD0952}\[CLSID]
delref {8ABE89E2-1A1E-469B-8AF0-0A111727CFA5}\[CLSID]
delref {8AC780E1-BCDB-4816-A6EA-A88BCC064453}\[CLSID]
delref {A0651028-BA7A-4D71-877F-12E0175A5806}\[CLSID]
delref %SystemDrive%\SOFT\TOR BROWSER\BROWSER\FIREFOX.EXE
delref %SystemDrive%\SOFT\IGAMES\JOAN OF ARC\VSETTING.EXE
delref %SystemDrive%\SOFT\IGAMES\JOAN OF ARC\UNWISE.EXE
delref %SystemDrive%\PROGRAM FILES\ORACLE\VIRTUALBOX GUEST ADDITIONS\UNINST.EXE
delref %SystemDrive%\PROGRAM FILES\ORACLE\VIRTUALBOX GUEST ADDITIONS\ORACLE VM VIRTUALBOX GUEST ADDITIONS.URL
delref %SystemDrive%\SOFT\IGAMES\GTA - VICE CITY\GTA-VC.EXE
;-------------------------------------------------------------

restart

  

ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} =>  -> No File
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} =>  -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} =>  -> No File
SearchScopes: HKU\S-1-5-21-1587541629-1866207419-1342301571-1001 -> DefaultScope {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxps://yandex.ru/search/?text={searchTerms}&clid=2233627
SearchScopes: HKU\S-1-5-21-1587541629-1866207419-1342301571-1001 -> {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxps://yandex.ru/search/?text={searchTerms}&clid=2233627
SearchScopes: HKU\S-1-5-21-1587541629-1866207419-1342301571-1004 -> DefaultScope {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxps://yandex.ru/search/?text={searchTerms}&clid=2233627
SearchScopes: HKU\S-1-5-21-1587541629-1866207419-1342301571-1004 -> {8C3078A0-9AAB-4371-85D1-656CA8E46EE8} URL = hxxps://yandex.ru/search/?text={searchTerms}&clid=2233627
FirewallRules: [{5173BA58-4EFE-40CD-977C-4EAAAAA5C22C}] => (Allow) C:\Users\Sergey\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{C61EEA9F-8AE9-4A68-82AE-0D435A5585B6}] => (Allow) C:\Users\Sergey\AppData\Roaming\Zoom\bin\airhost.exe => No File
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Edge StartupUrls: Default -> "hxxps://www.google.ru/search?newwindow=1&ei=KLrzXvrkMqLCmwWbiovwDg&q=cureit+download&oq=%D1%81%D0%B3%D0%BA%D1%83%D1%88%D0%B5&gs_lcp=CgZwc3ktYWIQAxgBMgYIABAKECoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAoyBAgAEAo6AggAOgYIABAKEB46CAgAEAUQChAeUIATWI0jYIUzaABwAHgAgAFSiAGjA5IBATeYAQCgAQGqAQdnd3Mtd2l6&sclient=psy-ab","hxxps://z-oleg.com/secur/avz/download.php","hxxps://www.google.com/search?q=sdfsfsdfas&oq=sdfsfsdfas&aqs=chrome..69i57j0l6.747j0j7&sourceid=chrome&ie=UTF-8","edge://newtab/"


EmptyTemp:
Reboot: