;;uVS v3.80.2 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

bl 456AF036C6282252297DBA9B5F217064 2312224
addsgn 1A18D29A5583C58CF42B254E3143FE58CCACF7F68971E02942C2B9100CD6993D8517C30EFDDE621CA06CD214B7FEAA0582201E375DDBC42B7B9F68D038F97BF8 8 GuardMail
zoo %Sys32%\RPCSS.DLL
bl 98B31CBC09D671DADEB7C92AEF1CBE29 110592
addsgn 988C1F7A092B4C9A4EC2AEB1DB5C120525013B1E9C9C1F780CA62D37A45F4F1ADC02BB077F5516073B0989CBE75749713BDB4B12F49BB0A77B7F2D3AA3A76373 32 OUC
bl 6C973F7DD4F2D0D7C6DACF314E72B8A4 84992
addsgn A7659219B952C52FFF5FF3BDEDBDEA8E5082758B757162680638C4C8135F0D682B9E9F733ADCA96DC3535C9F4695A5F6F8049D6BDECFB04CC41521FDC882AC73 64 BitcoinMayner
bl 5088915EF158EEF34E0488DAFA457E33 1664000
addsgn A76592CD0339CF9E275FDBB9EF951E8E589A7F0D888E22F1F9E7CD350CF275C517332BC63B559DCAC78C0144330FC2EF7D9FFF11D008BFA8A977A42F4E43C69B 64 BitcoinMayner
bl 63448B03F769293DB6AF381ED814EC0D 192512
addsgn A76592CC06E9A06280A1A2329AC96642ACFED8F202BF0FF1C1E7CD3715DEF84807FF896E3E55148AA86C881CB817466EBFEE28F78ED524ECA8B5D16842F0577F 64 BitcoinMayner
bl 8342ABDB2C64B569B3A7F7C1B871DE64 602624
addsgn A76592CD0339CF9E275FDBB9EF951E8E589A7F0D888E22F1F9E7CD350CF275C517332BC60D539DCAC78C0144330FC2EF7D0FC419D008BFA8A977A42F4E43C69B 64 BitcoinMayner
bl 73D4A9BDC7FA42BCF29F3CDD44DB2622 110094
addsgn A76592CD0339CF9E275FDBB9EF951E8E589A7F0D888E22F1F9E7CD350CF275C517332B8A85559DCAC78C0144330FC2EF7D4F8919D008BFA8A977A42F4E43C69B 64 BitcoinMayner
bl F8D780E7AC6236CC568E9FB6FE20F29C 352768
addsgn A76592CD0339CF9E275FDBB9EF951E8E589A7F0D888E22F1F9E7CD350CF275C517332B82EA569DCAC78C0144330FC2EF7DCFAD1CD008BFA8A977A42F4E43C69B 64 BitcoinMayner
bl EC63F649F7090F885EBD4770FFB92FCB 94208
addsgn A7679B19919AF4663F95AE5978DFEDFA4F8A945ABBBB1F10DDF084BC385A420D23AE73637F5527AD1FC18427BA2208FA9558688DAA32F229D288A42F38F9DD8C 8 updatetask
bl 68AF1C01341DA23A1D01FC487FEA8B6B 1582976
addsgn 1AA78B9A5583358CF42B254E3143FE547601B9FA0A3A13F1C03FA1374DD6714C239CC0339D559D492B0BC197CD4B457110236311A9255077E4B5AC2F9F5FA577 8 Praetor
bl 9CC5C24E0BCB282202C633F16402E3E1 795960
addsgn 1A06819A5583358CF42B627DA804DEC9E946303A4536D3F3D1E7C1371CF279BBE114C3573E20A1C229BA85EA681C898E5BE5897320FFBAC8596A65C7D73C6371 8 YandexUP
addsgn 1A8F449A5583E88CF42B627DA804DEC9E946303A4536D3F3C9E7C14B91D5714C2363E7DD3FD65C48AF40F0D1B1D74AFA7DDF9D9D50DAB02C2DFA000BC7062273 8 probably a variant of Win32/BitCoinMine
zoo %SystemDrive%\USERS\НАТАЛЬЯ\APPDATA\LOCAL\TEMP\CG\SVCHOST.EXE
bl 7A91C470D720045E87752F21F95A1835 598016
addsgn 0DC977BA156A4C720BD4AEB164C81205258AFCF689FA1F7885C3C5BC50D6714C2317C3573E559D492B80849F461649FA7DDFE87255DAB02C2D77A44FC7062E73 8 probably a variant of Win32/BitCoinMine
zoo %SystemDrive%\USERS\НАТАЛЬЯ\APPDATA\LOCAL\TEMP\CG\RUN.EXE
bl 4672B774636D6349B4672D5AC3B796D4 19968
chklst
delvir
EXEC cmd /c "rename %sys32%\rpcss.dll rpcss.dll.old" 
EXEC cmd /c "rename %sys32%\dllcache\rpcss.dll rpcss.dll.old" 
EXEC cmd /c "copy rpcss.dll %sys32%\rpcss.dll" 
EXEC cmd /c "copy rpcss.dll %sys32%\dllcache\rpcss.dll"
deltmp
delnfr
delref HTTP://MAIL.RU/CNT/7993/
delref HTTP://SEARCHFUNMOODS.COM/?F=2&A=IRONPUB12&IR=IRONPUB12&CD=2XZUYETN2Y1L1QZUTDTDTC0ETCTDTC0FTB0BYDTBTA0ETB0FTN0D0TZU0CTAYBZZTN1L2XZUTBTFTBTFTCTFYETDYB&CR=1782958288
delref HTTP://WEBALTA.RU/SEARCH
delref HTTP://WWW.MAIL.RU/CNT/5087
delref HTTP://WWW.MAIL.RU/CNT/7227
delref HTTP://WWW.MAIL.RU/CNT/9516
czoo
restart