;uVS v3.74 script [http://dsrt.dyndns.org]
;Target OS: NTv5.1

addsgn 3AE0779AEC6A4E720B5542A566C812BD378AFCF6DAAC9C94814AC998078022CFCF134A7B1A7C5546AD78849F46AD3AA53DDFAB21641ABD1C98875B3AC74D2D73 8 a variant of Win32/Kryptik.ACQN [NOD32]

zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\ZABERG.EXE
bl 1372F294D7C1DA13E593FC3EFE7D49EC 24064
addsgn 9252773A176AC1CC0BA4534E3341F788B9AE7C3776052EB8D5FA19C9AB90371F4BACC7533E021E8A2FD3ECACC81749ACFE1CEC21051DB32F2D75A4BF5796B2E3 8 a variant of Win32/Kryptik.ABYE [NOD32]

zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\ZLJAJZ.EXE
bl 62697687B70E1C789933930C6A3F3A61 107520
addsgn 3AE0779AECE24D720B5542A566C812BD378AFCF6DBAA9C94814AF998078022CFCF134A7B1A7C5546AD80859F46A92E443DDFAF25642C0E1C98875BAE1106697C 8 BackDoor.IRC.Bot.166 [DrWeb]

zoo %SystemRoot%\SADRIVE32.EXE
bl F8CAE6CECC506D0599912C3F9121E348 57344
addsgn 925277DA146AC1CC0B04504E3323193DAF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 8 Win32/SpamTool.Tedroo.AQ [NOD32]

zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\3B1.TMP
bl 4E42E1D48F2395BD565C2FA50AC2A0AE 125952
delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\ZLJAJZ.EXE
delall %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\ZABERG.EXE
delall %SystemRoot%\SADRIVE32.EXE
delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\3B1.TMP
delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\LLJAJL.EXE
delall E:\RECYCLER\S-51-9-25-3434476501-1644491933-602325628-1214\INSTM.EXE
adddir %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA

chklst
delvir
delall %SystemDrive%\PROGRAM FILES\PCHD\PCHDPLAYER.EXE
delref HTTP://SEARCH.QIP.RU
delref HTTP://WEBALTA.RU
delref HTTP://WWW.SMAXXI.BIZ
delall %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\APPLICATION DATA\MEDIAGET2\MEDIAGET.EXE
deltmp
delnfr
regt 5
crimg
restart