;uVS v3.77.15 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

zoo C:\Users\Александр\4230127.exe
zoo C:\Users\Александр\5620318.exe
zoo C:\Users\Александр\5662616.exe
zoo C:\Users\Александр\6112035.exe 
zoo C:\Users\Александр\7928606.exe
zoo C:\Users\Александр\AppData\Roaming\rundll32.exe
zoo C:\Users\Александр\AppData\Roaming\System32\svchost.exe
zoo C:\Windows\security\security.exe
zoo C:\Users\Александр\AppData\Roaming\System32\rundll32.exe
delall C:\Users\Александр\4230127.exe
delall C:\Users\Александр\5620318.exe
delall C:\Users\Александр\5662616.exe
delall C:\Users\Александр\6112035.exe 
delall C:\Users\Александр\7928606.exe
delall C:\Users\Александр\AppData\Roaming\rundll32.exe
delall C:\Users\Александр\AppData\Roaming\System32\svchost.exe
delall C:\Windows\security\security.exe
delall C:\Users\Александр\AppData\Roaming\System32\rundll32.exe
restart

;uVS v3.77.15 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

delall %SystemDrive%\USERS\АЛЕКСАНДР\0.8335792088355461.EXE
delall %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\ROAMING\SVCHOST.EXE
delall %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\ROAMING\FUNMOODS\UPDATEPROC\UPDATETASK.EXE
delall %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\ROAMING\SYSTEM32\CSRSS.EXE
delall %SystemRoot%\CURSORS\SERVICES.EXE
zoo %Sys32%\\ABALEZIP.DLL
delref %Sys32%\\ABALEZIP.DLL
delall %SystemRoot%\TEMP\NOD4C10.TMP
delref HTTP://SEARCHFUNMOODS.COM/?F=1&A=AGNUPD&CD=2XZUYETN2Y1L1QZU0B0CYD0F0FYETCZZTD0BZZZZ0ATATCZZTN0D0TZU0CYETAZYTN1L2XZUTN1L1CZU&CR=1205651491&IR=
delref HTTP://WEBALTA.RU/SEARCH
delref /C
delref HTTP://SEARCHFUNMOODS.COM/?F=1&A=IRON2&CHNL=IRON2&CD=2XZUYETN2Y1L1QZU0B0CYD0F0FYETCZZTD0BZZZZ0ATATCZZTN0D0TZU0CTATDYCTN1L2XZUTBTFTBTFTDTFTAYEYE&CR=2053194132
delref HTTP://SEARCHFUNMOODS.COM/?F=2&A=AGNUPD&CD=2XZUYETN2Y1L1QZU0B0CYD0F0FYETCZZTD0BZZZZ0ATATCZZTN0D0TZU0CYETAZYTN1L2XZUTN1L1CZU&CR=1205651491&IR=
delall %SystemRoot%\ASSEMBLY\GAC_MSIL\WEBALTASEARCH\1.1.0.0__CAE29F257FECBA88\WEBALTASEARCH.DLL
exec C:\PROGRAM FILES\FUNMOODS\1.5.23.22\UNINSTALL.EXE
exec "C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\QUICKSTORESTOOLBAR\UNINS000.EXE"
exec MSIEXEC.EXE /X{EE24665C-844A-4489-9F11-70E41F4EE476}
regt 3
regt 12
regt 18
deltmp
delnfr
restart