скрипт, на который вы ссылаетесь, был написан не для вас, а для другого пользователя.
(выполнять скрипты из других тем, даже если проблема аналогична, не рекомендуем)
добавьте образ автозапуска. сделайте его строго по инструкции.
Наш форум переведен в режим работы "только для чтения", публикация новых тем и сообщений недоступна. Мы искренне благодарны вам за то, что были с нами, но пришло время двигаться дальше. После официального ухода компании ESET с российского рынка мы приступили к разработке новых продуктов вместе с новыми партнёрами. Приглашаем вас присоединиться к нашему новому форуму PRO32.
Мы более не являемся эксклюзивным дистрибьютором программных продуктов словацкого разработчика ESET в России, Республике Беларусь, Казахстане, Азербайджане, Узбекистане, Кыргызстане, Таджикистане, Туркменистане, Молдове, Грузии и Армении.
Купить и продлить лицензии ESET на нашем сайте больше нельзя.
Предлагаем вам попробовать новые продукты компании PRO32.
PRO32 — это технологичные решения, надежная защита от киберугроз и максимальная производительность устройств. Для действующих клиентов ESET мы предлагаем промокод на скидку в размере 15% — ESET15. Скопируйте его и после добавления товара в корзину, не забудьте его применить в корзине.
Код |
---|
;uVS v4.0.14 [http://dsrt.dyndns.org] ;Target OS: NTv6.1 v400c OFFSGNSAVE ;------------------------autoscript--------------------------- deldirex %SystemDrive%\PROGRAM FILES\OPTIMIZER PRO 3.99 deldirex %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER deldirex %SystemDrive%\USERS\NIKKI\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER deldirex %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\MEDIA GET LLC\MEDIAGET2 deldirex %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\VOPACKAGE deldirex %SystemDrive%\USERS\NIKKI\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MEDIAGET2 delall %SystemDrive%\PROGRAMDATA\KBROWSER UTILITY\KBROWSER-UPDATER-UTILITY.EXE delall %SystemDrive%\PROGRAMDATA\KBUPDATER UTILITY\KBUPDATER-UTILITY.EXE delall %SystemDrive%\PROGRAM FILES\VUUPC\VUUPCUPDATER.EXE delall %SystemDrive%\PROGRAM FILES\VICETAMPA\VICETAMPA.DLL delref HTTP://SEARCH.CERTIFIED-TOOLBAR.COM?SI=85053&TID=29529&VER=7.0&TS=1414602000000.000007&TGUID=85053-29529-1414650370491-4426FF8C11020C2EAD7587D2B2747F51&ST=CHROME&Q= delref HTTP://SEARCH.GBOXAPP.COM/ delref %SystemDrive%\PROGRAMDATA\{D569DB90-E0C8-F7B7-D569-9DB90E0C6E43}\HQGHUMEAYLNLF.EXE delref %SystemDrive%\PROGRAM FILES\SYSTEMHEALER\SYSTEMHEALER.EXE delref %SystemDrive%\PROGRAM FILES\VIDEO SAVER 2\OW6ITX5.EXE delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\ADOBE\PPAPI\0AC7E08B-DF5E-44C2-AF6A-E051B3DA905B\19669F18-F9E5-42EF-951D-9F5A34CD321D.EXE delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\AMIGO\APPLICATION\AMIGO.EXE delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAMINLPMKFCDIBGPGFAJLGNAMICJCKKJF%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCNCGOHEPIHCEKKLOKHBHIBLHFCMIPBDH%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLGDNILODCPLJOMELBBNPGDOGDBMCLBNI%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPFIGAOAMNNCIJBGOMIFAMKMKIDNNLIKL%26INSTALLSOURCE%3DONDEMAND%26UC delref %SystemRoot%\SKINAPP.SYS delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\DDG.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\DDG.XML delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.2.9.0_0\СТАРТОВАЯ — ЯНДЕКС delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI\1.0.3_0\СТАРТОВАЯ — ЯНДЕКС delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.2.9.0_0\СТАРТОВАЯ — ЯНДЕКС delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI\1.0.3_0\СТАРТОВАЯ — ЯНДЕКС delref E:\HISUITEDOWNLOADER.EXE delref E:\AUTO.EXE delref E:\AUTORUN.EXE delref HTTP://YAMDEX.NET/?SEARCHID=1&L10N=RU&FROMSEARCH=1&TEXT={SEARCHTERMS} delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\YANDEX\BROWSERMANAGER\MBLAUNCHER.EXE del %SystemDrive%\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.URL delref %SystemDrive%\USERS\PICHUEVY\\APPDATA\ROAMING\VOPACKAGE\VOPACKAGE.EXE delref %SystemDrive%\USERS\PICHUEVY\\APPDATA\LOCAL\KOMETA\APPLICATION\KOMETA.EXE delref %SystemDrive%\USERS\NIKKI\\APPDATA\LOCAL\MEDIAGET2\MEDIAGET.EXE delref %SystemDrive%\USERS\NIKKI\\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE apply regt 28 regt 29 ; OpenAL exec C:\Program Files\OpenAL\oalinst.exe" /U deltmp delref %Sys32%\MACROMED\SHOCKWAVE 10\SYMINSTALLSTUB.EXE delref %SystemDrive%\PROGRAM FILES\COMMON FILES\DISTRIBUTE APPLICATION\APPDISTRIB.EXE delref %SystemDrive%\PROGRAM FILES\APPLE SOFTWARE UPDATE\SOFTWAREUPDATE.EXE delref %SystemDrive%\PROGRAM FILES\HOMETAB\WREMOTEUPDATER.EXE delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID] delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID] delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID] delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID] delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\MICROSOFT\DOWNLOADER.EXE delref %SystemDrive%\PROGRAM FILES\OPERA\LAUNCHER.EXE delref %SystemDrive%\PROGRAM FILES\OPTIMIZER PRO 3.99\OPTPROLAUNCHER.EXE delref %SystemDrive%\PROGRAM FILES\HOMETAB\WHOMEPAGESHIELD.EXE delref %SystemDrive%\PROGRA~1\SYSTEM~1\RESCUE~1.EXE delref %SystemDrive%\PROGRAM FILES\SYSTEMHEALER\HEALERCONSOLE.EXE delref %SystemDrive%\PROGRAM FILES\HOMETAB\WBROWSERSOCKETS.EXE delref %SystemDrive%\PROGRAM FILES\IOBIT\IOBIT UNINSTALLER\IOBITUNINSTALER.EXE delref J:\PROGRAM FILES\HI-REZ STUDIOS\HIREZGAMESDIAGANDSUPPORT.EXE delref J:\GAMES\ИГРЫ\EAUNINSTALL.EXE delref %SystemDrive%\PROGRAM FILES\IP-TV PLAYER\IPTVPLAYER.EXE delref J:\GAMES\ИГРЫ\WALL-E\WALL-E\GAMESETUP.EXE delref %SystemDrive%\PROGRAM FILES\MAIL.RU\GUARD\GUARDMAILRU.EXE delref D:\SUPPORT\NEED FOR SPEED UNDERCOVER_CODE.EXE delref {2DEDD2C9-928E-4442-9417-769C969973B6}\[CLSID] delref {35D6C101-8806-471F-BB44-C032E4384EF3}\[CLSID] delref {D0DBCCEC-6D2D-4149-A17B-FEBCE431A59C}\[CLSID] delref %Sys32%\DRIVERS\RDVGKMD.SYS delref {09900DE8-1DCA-443F-9243-26FF581438AF}\[CLSID] delref %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\SIMPLYTECH\HOME\HOME.HTM delref {013BCE80-4E50-4501-A798-4A06DAF7A334}\[CLSID] delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID] delref {0EA563EF-03EA-44BB-8F11-56FA5E43AE3F}\[CLSID] delref {192DE001-B010-46C8-A31B-06F95BA51F55}\[CLSID] delref {1975667D-7C5C-4485-B012-10E39E9FBC18}\[CLSID] delref {1B8C3A79-429C-40F5-9B86-758AF65A4E62}\[CLSID] delref {26FA2A11-C8FA-4F39-BA44-D88671C6BCFD}\[CLSID] delref {346A3799-68F2-420F-A8F4-B7C7A6544367}\[CLSID] delref {36802429-239D-4B57-9521-DAD3DE2576B9}\[CLSID] delref {3FAAA851-2FD1-4B58-992A-AE757E091741}\[CLSID] delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID] delref {4C3F9841-74D9-469E-B22D-A813A080257C}\[CLSID] delref {5010097B-CE9A-4F00-8240-6989DC36ADC2}\[CLSID] delref {565425BB-DA44-4639-B498-36B79EB9725A}\[CLSID] delref {59FE478E-A377-41A2-9B62-45EF74EBE7E6}\[CLSID] delref {5C5154FB-D8E1-46B4-ADB6-808BAC5ADC34}\[CLSID] delref {5C525F08-7CDB-4FA8-B051-74E2659AE93C}\[CLSID] delref {5E2BEAD0-AAD4-4E3E-A120-3B216B1984CC}\[CLSID] delref {6262E3E9-A0A4-4EF6-A4BD-0751751CB8CA}\[CLSID] delref {627FC297-E2A5-4939-BDC6-142026F9B400}\[CLSID] delref {81413192-6044-4F15-BCFC-430A941428C7}\[CLSID] delref {83679041-9059-4C42-BBC6-E57350AC91F0}\[CLSID] delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID] delref {8CBCF86C-045E-4138-8E84-A88AD63DB8F8}\[CLSID] delref {8FD6DD2E-DE2B-4A37-9B72-5B73B6E949F8}\[CLSID] delref {9363103F-C66B-41E7-8ACF-7C39A254B092}\[CLSID] delref {968ED98D-7F02-4BED-B08F-5DD676728BD7}\[CLSID] delref {A2BBBF13-0305-45FA-99FC-2FE55C22AF27}\[CLSID] delref {A6EF326F-ED1E-4A57-B97B-EB5255C2E264}\[CLSID] delref {A98D5669-7DF0-4ACA-A213-1E798B3BA03A}\[CLSID] delref {ABCF69A3-616C-40C6-94DE-9B1296A2AE33}\[CLSID] delref {B7DEDC66-4D1A-4BB6-B5E6-0180E5C1AA38}\[CLSID] delref {B8144703-9C10-4C4D-B114-306517D46F6A}\[CLSID] delref {C1F1626D-B4F1-46B7-9719-1A638A87F7F6}\[CLSID] delref {C3FC3222-CB61-4C4F-A50B-7634D5696404}\[CLSID] delref {CE46E1E9-63B4-4E0F-98FD-214A27955EB4}\[CLSID] delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID] delref {DFA88993-A84B-4310-87D6-E32E672BED0F}\[CLSID] delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID] delref %Sys32%\BLANK.HTM delref {DD230880-495A-11D1-B064-008048EC2FC5}\[CLSID] delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID] delref {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}\[CLSID] delref {0563DB41-F538-4B37-A92D-4659049B7766}\[CLSID] delref HELPSVC\[SERVICE] delref SACSVR\[SERVICE] delref TBS\[SERVICE] delref VMMS\[SERVICE] delref WINDEFEND\[SERVICE] delref MESSENGER\[SERVICE] delref RDSESSMGR\[SERVICE] delref %Sys32%\DRIVERS\ESETCLEANERSDRIVER.SYS delref %SystemRoot%\XHUNTER1.SYS delref %Sys32%\PSXSS.EXE delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD} delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\DISTRIBUTION\SEARCHPLUGINS\COMMON\YASEARCH.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX.XML delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL delref %Sys32%\SHAREMEDIACPL.CPL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL delref K:\LENOVO_SUITE.EXE delref E:\LENOVO_SUITE.EXE delref I:\START.HTA delref %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\MAIL.RU\AGENT\MAGENT.EXE delref {00000000-0000-0000-0000-000000000000}\[CLSID] delref {01015047-EA84-0012-FA3F-000000020000}\[CLSID] delref {093500E9-F79F-4C52-A9B5-D8C7E4B3023E}\[CLSID] delref {18DF081C-E8AD-4283-A596-FA578C2EBDC3}\[CLSID] delref {3507FA00-ADA2-4A02-99B9-51AD26CA9120}\[CLSID] delref {5A8FF410-F3CE-4844-B31B-F18D911239E8}\[CLSID] delref {7558B7E5-7B26-4201-BEDB-00D5FF534523}\[CLSID] delref {7F03982E-7FC7-4A91-90F9-25F9A8A4F62F}\[CLSID] delref {810B649C-CEAE-4AC9-BF26-81341B49E913}\[CLSID] delref {86A88967-7A20-11D2-8EDA-00600818EDB1}\[CLSID] delref {C66D064F-82FE-4E1A-B06A-B2490BA48B18}\[CLSID] delref {C7C0AE71-D971-4CD8-8F02-C4452BE2C676}\[CLSID] delref {FC77AB1C-824C-416F-95BC-418029595B48}\[CLSID] delref L:\LENOVO_SUITE.EXE delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\MAIL.RU\GAMECENTER\NPDETECTOR.DLL delref %SystemDrive%\USERS\NIKKI\APPDATA\ROAMING\MAIL.RU\AGENT\MAGENT.EXE delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\D.URL delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\SUBWAY_SURFERS.EXE delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\UNINSTALL.EXE delref %SystemDrive%\PROGRAM FILES\KINOROOM BROWSER\KINOROOM-BROWSER.EXE delref %SystemDrive%\VKONTAKTEDJ\VKONTAKTEDJ.EXE delref J:\СЛАЙД ШОУ 2017\SLIDESHOW CREATOR\SLIDESHOW.EXE delref %SystemDrive%\PROGRAM FILES\ДЕКЛАРАЦИЯ 2016\DECL2016.EXE delref J:\GAMES\SYEAM\STEAM\STEAM.EXE delref %SystemDrive%\GAMEXP\ACCESSPOINT\ACCESSPOINT.EXE delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.BAT delref J:\GAMES\UNINSTALL.EXE delref J:\GAMES\RAIDCALL\UNINST.EXE delref J:\GAMES\ИГРЫ\HAMSTERBALLGOLD_[TFILE.RU]\HAMSTERBALL\HAMSTERBALL.EXE delref J:\GAMES\ИГРЫ\HAMSTERBALLGOLD_[TFILE.RU]\HAMSTERBALL\UNINS000.EXE delref %SystemDrive%\PROGRAM FILES\SCREEN CAPTURE\SCREENCAPTURE.EXE delref %SystemDrive%\PROGRAM FILES\SCREEN CAPTURE\UNINS000.EXE ;------------------------------------------------------------- restart |
Код |
---|
;uVS v4.0.14 [http://dsrt.dyndns.org] ;Target OS: NTv10.0 v400c OFFSGNSAVE ;------------------------autoscript--------------------------- delref HTTPS://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?P=MKO_AWFZXIPYRAHDGKBRHOJYN9_5EDL7QPPMXLVOCDRHYVQM9U576TKO5BQ6POVOWZMC1VFT4YX0DH1Q9R_AMCXRS-528GOLW4WBVDX87VTQNHROCR3-9KIQ-V9RU3RZ7FOUU8KI3ZZQXWGV_B_2WODPGNUBE3TYM1LHXIM4EXOXDJKWPHSSCAOHH0EK50 delref HTTPS://NEWTAB.CLUB delall %SystemRoot%\TEMP\JZKOEBITVPFCRZRE\BPOCLNPRX.EXE delall %SystemRoot%\TEMP\INLCPPNPCTGODNIY\PEADILODD.EXE delall %SystemDrive%\PROGRAMDATA\WINDOWSMENU\WESTAT.EXE delall %SystemDrive%\PROGRAM FILES (X86)\YKZSZAYRFZZSC\CVCVUWZ.DLL delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\DUOZAP.REG delall %SystemDrive%\PROGRAM FILES (X86)\LWUEOSHGOBPOUROJZER\FADMHUO.DLL delall %SystemDrive%\PROGRAMDATA\BQLRBDPGLIGGRXVB\GKUZXPL.WSF delall %SystemDrive%\PROGRAM FILES (X86)\AOPBTRQYU\IEQXEO.DLL delall %SystemDrive%\PROGRAM FILES (X86)\SJUIFJJOVMHU2\IINEUQNXPESOM.DLL delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\JOB-LIGHT.REG delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\RONCOF.REG delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\STATLIGHT.REG delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\TAMPSANTRAX.REG delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\TEMPCOM.REG delref HTTP://OVGORSKIY.RU delref HTTP://WWW.SWEET-PAGE.COM/?TYPE=HP&TS=1414158211&FROM=COR&UID=SAMSUNGXHM321HI_S265J90B183093183093 apply regt 27 deltmp delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE15\OLICENSEHEARTBEAT.EXE delref {9F2B0085-9218-42A1-88B0-9F0E65851666}\[CLSID] delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID] delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL delref {5AA199A0-1CED-43A5-9B85-3226086738A3}\[CLSID] delref {DEF03232-9688-11E2-BE7F-B4B52FD966FF}\[CLSID] delref %SystemDrive%\PROGRAM FILES\REMPL\REMSH.EXE delref %Sys32%\EOSNOTIFY.EXE delref %Sys32%\NOTIFIER.EXE delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS delref %SystemRoot%\SYSWOW64\APPVETWCLIENTRES.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCLR.SYS delref %SystemRoot%\SYSWOW64\W32TIME.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL delref %SystemRoot%\SYSWOW64\CSCSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\SMBDIRECT.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL delref %SystemRoot%\SYSWOW64\LSM.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID] delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID] delref {19916E01-B44E-4E31-94A4-4696DF46157B}\[CLSID] delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID] delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID] delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID] delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID] delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID] delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID] delref %SystemRoot%\SYSWOW64\BLANK.HTM delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID] delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID] delref {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\[CLSID] delref %Sys32%\DRIVERS\VMBUSR.SYS delref %Sys32%\HVSICONTAINERSERVICE.DLL delref %Sys32%\WINDOWSANYTIMEUPGRADERESULTS.EXE delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL delref %Sys32%\BLANK.HTM delref SMART MOUNT SHELL EXTENSION\[CLSID] delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID] delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS delref HELPSVC\[SERVICE] delref SACSVR\[SERVICE] delref TBS\[SERVICE] delref %Sys32%\DRIVERS\USBAUDIO.SYS delref VMMS\[SERVICE] delref MESSENGER\[SERVICE] delref RDSESSMGR\[SERVICE] delref %Sys32%\MSMIRADISP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL delref %Sys32%\TETHERINGSETTINGHANDLER.DLL delref %Sys32%\QUICKACTIONSPS.DLL delref %Sys32%\IGFXOSP.DLL delref %Sys32%\CHTADVANCEDDS.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL delref %SystemRoot%\SYSWOW64\TTLSEXT.DLL delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE delref %SystemRoot%\SYSWOW64\TAPILUA.DLL delref %SystemRoot%\SYSWOW64\WBEM\KEYBOARDFILTERWMI.DLL delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL delref %SystemRoot%\SYSWOW64\PERCEPTIONSIMULATIONEXTENSIONS.DLL delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\KI127176.INF_AMD64_86C658CABFB17C9C\IGFXEXPS32.DLL delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL delref %SystemRoot%\SYSWOW64\MAPSCSP.DLL delref %SystemRoot%\SYSWOW64\LISTSVC.DLL delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\AZBJTDWTZIE\XYNZJYUIRU.EXE delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE delref %SystemRoot%\SYSWOW64\GPSVC.DLL delref %SystemRoot%\SYSWOW64\CONNECTEDSTORAGESERVICE.PROXYSTUB.DLL delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL ;------------------------------------------------------------- restart |
Цитата |
---|
This ransomware is still under analysis. Please refer to the appropriate topic for more information. Samples of encrypted files and suspicious files may be needed for continued investigation. Identified by ransomnote_filename: Dont_Worry.txt sample_extension: .UPS-<random16> Not enough information is public about AMBA. Please check back later. |
Код |
---|
;uVS v4.0.13 [http://dsrt.dyndns.org] ;Target OS: NTv10.0 v400c OFFSGNSAVE zoo %SystemDrive%\PROGRAMDATA\81BAB96A-365C-4743-8348-D1FCDA09A124\B0160.EXE zoo %SystemDrive%\PROGRAMDATA\MBVHOST.EXE ;------------------------autoscript--------------------------- delall %SystemDrive%\PROGRAMDATA\81BAB96A-365C-4743-8348-D1FCDA09A124\B0160.EXE delall %SystemDrive%\PROGRAMDATA\MBVHOST.EXE delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AOJOECKCMJGHLCHNNENFKBFLNDBEPJPK\8.23.0_0\ПОИСК И СТАРТОВАЯ — ЯНДЕКС apply deltmp delref %SystemRoot%\SYSWOW64\HASPLMS.EXE delref %SystemRoot%\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\FONTCACHE\FONTS\DOWNLOAD-1.TMP delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID] delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVESTANDALONEUPDATER.EXE delref %SystemDrive%\PROGRAMDATA\IOSTREAM.EXE delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS delref %SystemRoot%\SYSWOW64\APPVETWCLIENTRES.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCLR.SYS delref %SystemRoot%\SYSWOW64\W32TIME.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL delref %SystemRoot%\SYSWOW64\CSCSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\SMBDIRECT.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL delref %SystemRoot%\SYSWOW64\LSM.DLL delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID] delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID] delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID] delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID] delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID] delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID] delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID] delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID] delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID] delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID] delref %SystemRoot%\SYSWOW64\BLANK.HTM delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID] delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID] delref {BBACC218-34EA-4666-9D7A-C78F2274A524}\[CLSID] delref {5AB7172C-9C11-405C-8DD5-AF20F3606282}\[CLSID] delref {A78ED123-AB77-406B-9962-2A5D9D2F7F30}\[CLSID] delref {F241C880-6982-4CE5-8CF7-7085BA96DA5A}\[CLSID] delref {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\[CLSID] delref {9AA2F32D-362A-42D9-9328-24A483E2CCC3}\[CLSID] delref {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\[CLSID] delref %Sys32%\DRIVERS\VMBUSR.SYS delref %Sys32%\HVSICONTAINERSERVICE.DLL delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL delref %Sys32%\BLANK.HTM delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS delref HELPSVC\[SERVICE] delref SACSVR\[SERVICE] delref TBS\[SERVICE] delref %Sys32%\DRIVERS\USBAUDIO.SYS delref VMMS\[SERVICE] delref BROWSER\[SERVICE] delref MESSENGER\[SERVICE] delref RDSESSMGR\[SERVICE] delref %SystemDrive%\PROGRAM FILES\NVIDIA CORPORATION\DISPLAY\NVLICENSINGS.DLL delref %Sys32%\TETHERINGSETTINGHANDLER.DLL delref %Sys32%\QUICKACTIONSPS.DLL delref %Sys32%\CHTADVANCEDDS.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL delref %SystemRoot%\SYSWOW64\TTLSEXT.DLL delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE delref %SystemRoot%\SYSWOW64\TAPILUA.DLL delref %SystemRoot%\SYSWOW64\WBEM\KEYBOARDFILTERWMI.DLL delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL delref %SystemRoot%\SYSWOW64\PERCEPTIONSIMULATIONEXTENSIONS.DLL delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL delref %SystemRoot%\SYSWOW64\MAPSCSP.DLL delref %SystemRoot%\SYSWOW64\LISTSVC.DLL delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE delref %SystemRoot%\SYSWOW64\GPSVC.DLL delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVE.EXE ;------------------------------------------------------------- restart |
Цитата |
---|
Андрей Калинин написал: К сожалению eset по каким то причинам при нажатии а кнопку удалить ( майнеры нашелся в оперативной памяти) написал что ошибка удаления |