;uVS v3.77.9 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

bl D938F5F2759BD2FF169141C469A15A71 1603104
addsgn 1A06FB9A5583C58CF42B254E3143FE8E6082CF3FB2FED2004095C5C84397F2B50E6532DA76B81EB03AF78AF54B4E1439F6DB250E908CB071EE72E0D038F9487D 8 MailUpdater
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\31CB.EXE
bl 32F3E3D093DB00FC492D1FC9D65B7531 123775
addsgn 9A287F9A55024C720BD4C639EC8812EDD9A5FCF60A3E131085C3C5BD51235E4C23B44FDF7E55F5492B8084F7460649FA15DFE872553252032D7707A74F46229B 8 UDS:DangerousObject.Multi.Generic [Kasp
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\MICROSOFT\XSHCHZ.EXE
bl 595DD6B82DA16EFF1979DA76F316645B 130560
adddir %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING
chklst
delvir
deltmp
delnfr
exec MSIEXEC.EXE /X{26A24AE4-039D-4CA4-87B4-2F83216038FF}
restart

;;uVS v3.77.9 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

bl 751C3F58A618CF7DE40042D44AD06590 2295328
addsgn 1A18D29A5583C58CF42B254E3143FE58CCACF7F68971E02942C2B9100CD6993D8517C30EFDDE621CA06CD214B7FEAA0582201E375DDBC42B7B9F68D038F97BF8 8 GuardMail
bl 01907300EB52206B06FACB9608F369A9 625816
addsgn 9252773A006AC1CC0BA4444EA34FF6AC3D8A32B34DD148FB483C2EB2C046E1DCA91185DF39129C925E870F81C5F8B5EBA6AD05CA54DAB02C2CACD1284C18A19D 8 Pandora
bl 7FB282509685C53EDF1BE190353913FB 507776
addsgn 1A8FD09A5583358CF42B254E3143FE865886FC8282903222E34AD43F91D48694759C3264ECA2E841A87A8DE943958BAD96DC6BB065BC393D6C3621EFB0E311B3 8 YandexUPD
zoo %SystemRoot%\PMDRIVE32.EXE
bl 52C224323A03DEA18574401C31C335A0 68206
addsgn A7679BF0AA029C224BD4C6B947881261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C03D0C49F75C4C32EF4CAD81B15DA3BE4AC965B2FC706AB7E 8 Win32/AutoRun.KS [NOD32]
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\DSITE\UPDATEPROC\UPDATETASK.EXE
bl CD043EB9F60A095302936524AE86A5E9 84992
addsgn A7679B235D6A4C7261D4C4B12DBDEB5476DCAB4E898B5E786D942A42AF68B9806217F0976B3DCDC66A80E0607672C0DA17DF005BA4244F442C76A42FAF2EEB32 16 Win32/TrojanDownloader.Carberp.AD
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-46689\24NAQ.EXE
bl 516BB6B2D03724F9C60E1CAC9CC174F1 73728
addsgn 1A0A639A5583C58CF42B254E3143FE84C9A2FFF689592784C5C34CB1642A314CAA02F3AB7E551454077CC49FCF2361063DDF614F7126F02C4BFBB17F3B462215 8 Trojan-Ransom.Win32.Blocker.uxw
bl F082C76CF8A1C41DB23EC397B4B5B03B 1618304
addsgn 1AF67A9B5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 Praetor
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17255\PROXZY15.EXE
bl 939E55FBCF61EB903FD4F5E1F8CF6C35 42235
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17253\PROXZY13.EXE
bl 65507B1465546E3C35E93751E7F5B039 44735
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-10259\PROXZY109.EXE
bl B1D158217751806A804C4ECAEA333F60 41990
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17258\PROXZY18.EXE
bl CAFED638C1B3341C34198EDC05FE7A95 45430
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17256\PROXZY16.EXE
bl B83506982520C0866C50FEE4285A7841 43715
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17254\PROXZY14.EXE
bl 8FB9E793040BB6D62E50400E6F4D3396 45750
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17251\PROXZY12.EXE
bl E2342D2E17FE5E4DE3EDAFEC6FEA86DE 43880
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17259\PROXZY19.EXE
bl 8546F0D0A921ABC2A9E48973C7605FBB 41210
zoo %SystemDrive%\RECYCLER\S-1-5-21-0243556031-888888379-781863308-17257\PROXZY17.EXE
bl 7AEDA63CC0F24C620D43E19389B0EBBA 44575
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\BD65.EXE
bl DC231035327F822F892CEAF59E800F8D 66191
zoo %SystemRoot%\SYSWOW64\DISCHANDLER.EXE
bl F4953D7E6555B707AEE3EE70C8A42BD0 39904
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\7FD9.EXE
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\88D6.EXE
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\A341.EXE
addsgn 9A287F9A55024C720BD4C639EC8812EDD9A5FCF60A3E131085C3C5BD51235E4C23B44FDF7E55F5492B8084F7460649FA15DFE872553252032D7707A74F46229B 8 UDS:DangerousObject.Multi.Generic [Kasp
zoo %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING\D662.EXE
bl 32F3E3D093DB00FC492D1FC9D65B7531 123775
adddir %SystemDrive%\USERS\АНДРЕЙ\APPDATA\ROAMING
exec MSIEXEC.EXE /X{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}
exec "C:\PROGRAM FILES (X86)\DELTA\DELTA\1.8.10.0\GUNINSTALLER.EXE" -UPRTC /TBGEN= -KEY "DELTA"
exec "C:\USERS\АНДРЕЙ\APPDATA\ROAMING\BABSOLUTION\SHARED\GUNINSTALLER.EXE" -KEY "DELTA CHROME TOOLBAR" -RMKEY -ASK
exec "C:\PROGRAM FILES (X86)\MAIL.RU\GUARD\GUARDMAILRU.EXE" /UNINSTALL
exec "C:\PROGRAM FILES (X86)\PANDORA.TV\PANSERVICE\UNINS000.EXE"
chklst
delvir
deltmp
delnfr
delref HTTP://ISEARCH.BABYLON.COM/?AFFID=119370&TT=180313_NX&BABSRC=HP_SS_D2G&MNTRID=B85500093BF01A40
delref HTTP://SAMSUNG.MSN.COM
delref HTTP://WWW.DELTA-SEARCH.COM/?AFFID=119370&TT=180313_NX&BABSRC=HP_SS&MNTRID=B85500093BF01A40
czoo
restart