скрипт, на который вы ссылаетесь, был написан не для вас, а для другого пользователя.
(выполнять скрипты из других тем, даже если проблема аналогична, не рекомендуем)
добавьте образ автозапуска. сделайте его строго по инструкции.
Наш форум переведен в режим работы "только для чтения", публикация новых тем и сообщений недоступна. Мы искренне благодарны вам за то, что были с нами, но пришло время двигаться дальше. После официального ухода компании ESET с российского рынка мы приступили к разработке новых продуктов вместе с новыми партнёрами. Приглашаем вас присоединиться к нашему новому форуму PRO32.
Мы более не являемся эксклюзивным дистрибьютором программных продуктов словацкого разработчика ESET в России, Республике Беларусь, Казахстане, Азербайджане, Узбекистане, Кыргызстане, Таджикистане, Туркменистане, Молдове, Грузии и Армении.
Купить и продлить лицензии ESET на нашем сайте больше нельзя.
Предлагаем вам попробовать новые продукты компании PRO32.
PRO32 — это технологичные решения, надежная защита от киберугроз и максимальная производительность устройств. Для действующих клиентов ESET мы предлагаем промокод на скидку в размере 15% — ESET15. Скопируйте его и после добавления товара в корзину, не забудьте его применить в корзине.
| Код |
|---|
;uVS v4.0.14 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------
deldirex %SystemDrive%\PROGRAM FILES\OPTIMIZER PRO 3.99
deldirex %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER
deldirex %SystemDrive%\USERS\NIKKI\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER
deldirex %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\MEDIA GET LLC\MEDIAGET2
deldirex %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\VOPACKAGE
deldirex %SystemDrive%\USERS\NIKKI\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MEDIAGET2
delall %SystemDrive%\PROGRAMDATA\KBROWSER UTILITY\KBROWSER-UPDATER-UTILITY.EXE
delall %SystemDrive%\PROGRAMDATA\KBUPDATER UTILITY\KBUPDATER-UTILITY.EXE
delall %SystemDrive%\PROGRAM FILES\VUUPC\VUUPCUPDATER.EXE
delall %SystemDrive%\PROGRAM FILES\VICETAMPA\VICETAMPA.DLL
delref HTTP://SEARCH.CERTIFIED-TOOLBAR.COM?SI=85053&TID=29529&VER=7.0&TS=1414602000000.000007&TGUID=85053-29529-1414650370491-4426FF8C11020C2EAD7587D2B2747F51&ST=CHROME&Q=
delref HTTP://SEARCH.GBOXAPP.COM/
delref %SystemDrive%\PROGRAMDATA\{D569DB90-E0C8-F7B7-D569-9DB90E0C6E43}\HQGHUMEAYLNLF.EXE
delref %SystemDrive%\PROGRAM FILES\SYSTEMHEALER\SYSTEMHEALER.EXE
delref %SystemDrive%\PROGRAM FILES\VIDEO SAVER 2\OW6ITX5.EXE
delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\ADOBE\PPAPI\0AC7E08B-DF5E-44C2-AF6A-E051B3DA905B\19669F18-F9E5-42EF-951D-9F5A34CD321D.EXE
delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\AMIGO\APPLICATION\AMIGO.EXE
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAMINLPMKFCDIBGPGFAJLGNAMICJCKKJF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCNCGOHEPIHCEKKLOKHBHIBLHFCMIPBDH%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLGDNILODCPLJOMELBBNPGDOGDBMCLBNI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPFIGAOAMNNCIJBGOMIFAMKMKIDNNLIKL%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemRoot%\SKINAPP.SYS
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\DDG.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\DDG.XML
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.2.9.0_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI\1.0.3_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.2.9.0_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI\1.0.3_0\СТАРТОВАЯ — ЯНДЕКС
delref E:\HISUITEDOWNLOADER.EXE
delref E:\AUTO.EXE
delref E:\AUTORUN.EXE
delref HTTP://YAMDEX.NET/?SEARCHID=1&L10N=RU&FROMSEARCH=1&TEXT={SEARCHTERMS}
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\YANDEX\BROWSERMANAGER\MBLAUNCHER.EXE
del %SystemDrive%\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.URL
delref %SystemDrive%\USERS\PICHUEVY\\APPDATA\ROAMING\VOPACKAGE\VOPACKAGE.EXE
delref %SystemDrive%\USERS\PICHUEVY\\APPDATA\LOCAL\KOMETA\APPLICATION\KOMETA.EXE
delref %SystemDrive%\USERS\NIKKI\\APPDATA\LOCAL\MEDIAGET2\MEDIAGET.EXE
delref %SystemDrive%\USERS\NIKKI\\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE
apply
regt 28
regt 29
; OpenAL
exec C:\Program Files\OpenAL\oalinst.exe" /U
deltmp
delref %Sys32%\MACROMED\SHOCKWAVE 10\SYMINSTALLSTUB.EXE
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\DISTRIBUTE APPLICATION\APPDISTRIB.EXE
delref %SystemDrive%\PROGRAM FILES\APPLE SOFTWARE UPDATE\SOFTWAREUPDATE.EXE
delref %SystemDrive%\PROGRAM FILES\HOMETAB\WREMOTEUPDATER.EXE
delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID]
delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID]
delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID]
delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID]
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\LOCAL\MICROSOFT\DOWNLOADER.EXE
delref %SystemDrive%\PROGRAM FILES\OPERA\LAUNCHER.EXE
delref %SystemDrive%\PROGRAM FILES\OPTIMIZER PRO 3.99\OPTPROLAUNCHER.EXE
delref %SystemDrive%\PROGRAM FILES\HOMETAB\WHOMEPAGESHIELD.EXE
delref %SystemDrive%\PROGRA~1\SYSTEM~1\RESCUE~1.EXE
delref %SystemDrive%\PROGRAM FILES\SYSTEMHEALER\HEALERCONSOLE.EXE
delref %SystemDrive%\PROGRAM FILES\HOMETAB\WBROWSERSOCKETS.EXE
delref %SystemDrive%\PROGRAM FILES\IOBIT\IOBIT UNINSTALLER\IOBITUNINSTALER.EXE
delref J:\PROGRAM FILES\HI-REZ STUDIOS\HIREZGAMESDIAGANDSUPPORT.EXE
delref J:\GAMES\ИГРЫ\EAUNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES\IP-TV PLAYER\IPTVPLAYER.EXE
delref J:\GAMES\ИГРЫ\WALL-E\WALL-E\GAMESETUP.EXE
delref %SystemDrive%\PROGRAM FILES\MAIL.RU\GUARD\GUARDMAILRU.EXE
delref D:\SUPPORT\NEED FOR SPEED UNDERCOVER_CODE.EXE
delref {2DEDD2C9-928E-4442-9417-769C969973B6}\[CLSID]
delref {35D6C101-8806-471F-BB44-C032E4384EF3}\[CLSID]
delref {D0DBCCEC-6D2D-4149-A17B-FEBCE431A59C}\[CLSID]
delref %Sys32%\DRIVERS\RDVGKMD.SYS
delref {09900DE8-1DCA-443F-9243-26FF581438AF}\[CLSID]
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\SIMPLYTECH\HOME\HOME.HTM
delref {013BCE80-4E50-4501-A798-4A06DAF7A334}\[CLSID]
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {0EA563EF-03EA-44BB-8F11-56FA5E43AE3F}\[CLSID]
delref {192DE001-B010-46C8-A31B-06F95BA51F55}\[CLSID]
delref {1975667D-7C5C-4485-B012-10E39E9FBC18}\[CLSID]
delref {1B8C3A79-429C-40F5-9B86-758AF65A4E62}\[CLSID]
delref {26FA2A11-C8FA-4F39-BA44-D88671C6BCFD}\[CLSID]
delref {346A3799-68F2-420F-A8F4-B7C7A6544367}\[CLSID]
delref {36802429-239D-4B57-9521-DAD3DE2576B9}\[CLSID]
delref {3FAAA851-2FD1-4B58-992A-AE757E091741}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {4C3F9841-74D9-469E-B22D-A813A080257C}\[CLSID]
delref {5010097B-CE9A-4F00-8240-6989DC36ADC2}\[CLSID]
delref {565425BB-DA44-4639-B498-36B79EB9725A}\[CLSID]
delref {59FE478E-A377-41A2-9B62-45EF74EBE7E6}\[CLSID]
delref {5C5154FB-D8E1-46B4-ADB6-808BAC5ADC34}\[CLSID]
delref {5C525F08-7CDB-4FA8-B051-74E2659AE93C}\[CLSID]
delref {5E2BEAD0-AAD4-4E3E-A120-3B216B1984CC}\[CLSID]
delref {6262E3E9-A0A4-4EF6-A4BD-0751751CB8CA}\[CLSID]
delref {627FC297-E2A5-4939-BDC6-142026F9B400}\[CLSID]
delref {81413192-6044-4F15-BCFC-430A941428C7}\[CLSID]
delref {83679041-9059-4C42-BBC6-E57350AC91F0}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {8CBCF86C-045E-4138-8E84-A88AD63DB8F8}\[CLSID]
delref {8FD6DD2E-DE2B-4A37-9B72-5B73B6E949F8}\[CLSID]
delref {9363103F-C66B-41E7-8ACF-7C39A254B092}\[CLSID]
delref {968ED98D-7F02-4BED-B08F-5DD676728BD7}\[CLSID]
delref {A2BBBF13-0305-45FA-99FC-2FE55C22AF27}\[CLSID]
delref {A6EF326F-ED1E-4A57-B97B-EB5255C2E264}\[CLSID]
delref {A98D5669-7DF0-4ACA-A213-1E798B3BA03A}\[CLSID]
delref {ABCF69A3-616C-40C6-94DE-9B1296A2AE33}\[CLSID]
delref {B7DEDC66-4D1A-4BB6-B5E6-0180E5C1AA38}\[CLSID]
delref {B8144703-9C10-4C4D-B114-306517D46F6A}\[CLSID]
delref {C1F1626D-B4F1-46B7-9719-1A638A87F7F6}\[CLSID]
delref {C3FC3222-CB61-4C4F-A50B-7634D5696404}\[CLSID]
delref {CE46E1E9-63B4-4E0F-98FD-214A27955EB4}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {DFA88993-A84B-4310-87D6-E32E672BED0F}\[CLSID]
delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref %Sys32%\BLANK.HTM
delref {DD230880-495A-11D1-B064-008048EC2FC5}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}\[CLSID]
delref {0563DB41-F538-4B37-A92D-4659049B7766}\[CLSID]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref TBS\[SERVICE]
delref VMMS\[SERVICE]
delref WINDEFEND\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\DRIVERS\ESETCLEANERSDRIVER.SYS
delref %SystemRoot%\XHUNTER1.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD}
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\DISTRIBUTION\SEARCHPLUGINS\COMMON\YASEARCH.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\GOOGLE.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\PRICERU.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\WIKIPEDIA-RU.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX-SLOVARI.XML
delref J:\GAMES\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\YANDEX.XML
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL
delref %Sys32%\SHAREMEDIACPL.CPL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL
delref K:\LENOVO_SUITE.EXE
delref E:\LENOVO_SUITE.EXE
delref I:\START.HTA
delref %SystemDrive%\USERS\PICHUEVY\APPDATA\ROAMING\MAIL.RU\AGENT\MAGENT.EXE
delref {00000000-0000-0000-0000-000000000000}\[CLSID]
delref {01015047-EA84-0012-FA3F-000000020000}\[CLSID]
delref {093500E9-F79F-4C52-A9B5-D8C7E4B3023E}\[CLSID]
delref {18DF081C-E8AD-4283-A596-FA578C2EBDC3}\[CLSID]
delref {3507FA00-ADA2-4A02-99B9-51AD26CA9120}\[CLSID]
delref {5A8FF410-F3CE-4844-B31B-F18D911239E8}\[CLSID]
delref {7558B7E5-7B26-4201-BEDB-00D5FF534523}\[CLSID]
delref {7F03982E-7FC7-4A91-90F9-25F9A8A4F62F}\[CLSID]
delref {810B649C-CEAE-4AC9-BF26-81341B49E913}\[CLSID]
delref {86A88967-7A20-11D2-8EDA-00600818EDB1}\[CLSID]
delref {C66D064F-82FE-4E1A-B06A-B2490BA48B18}\[CLSID]
delref {C7C0AE71-D971-4CD8-8F02-C4452BE2C676}\[CLSID]
delref {FC77AB1C-824C-416F-95BC-418029595B48}\[CLSID]
delref L:\LENOVO_SUITE.EXE
delref %SystemDrive%\USERS\NIKKI\APPDATA\LOCAL\MAIL.RU\GAMECENTER\NPDETECTOR.DLL
delref %SystemDrive%\USERS\NIKKI\APPDATA\ROAMING\MAIL.RU\AGENT\MAGENT.EXE
delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\D.URL
delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\SUBWAY_SURFERS.EXE
delref J:\GAMES\ИГРЫ\SUBWAY SURFERS\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES\KINOROOM BROWSER\KINOROOM-BROWSER.EXE
delref %SystemDrive%\VKONTAKTEDJ\VKONTAKTEDJ.EXE
delref J:\СЛАЙД ШОУ 2017\SLIDESHOW CREATOR\SLIDESHOW.EXE
delref %SystemDrive%\PROGRAM FILES\ДЕКЛАРАЦИЯ 2016\DECL2016.EXE
delref J:\GAMES\SYEAM\STEAM\STEAM.EXE
delref %SystemDrive%\GAMEXP\ACCESSPOINT\ACCESSPOINT.EXE
delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.BAT
delref J:\GAMES\UNINSTALL.EXE
delref J:\GAMES\RAIDCALL\UNINST.EXE
delref J:\GAMES\ИГРЫ\HAMSTERBALLGOLD_[TFILE.RU]\HAMSTERBALL\HAMSTERBALL.EXE
delref J:\GAMES\ИГРЫ\HAMSTERBALLGOLD_[TFILE.RU]\HAMSTERBALL\UNINS000.EXE
delref %SystemDrive%\PROGRAM FILES\SCREEN CAPTURE\SCREENCAPTURE.EXE
delref %SystemDrive%\PROGRAM FILES\SCREEN CAPTURE\UNINS000.EXE
;-------------------------------------------------------------
restart
|
| Код |
|---|
;uVS v4.0.14 [http://dsrt.dyndns.org]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------
delref HTTPS://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?P=MKO_AWFZXIPYRAHDGKBRHOJYN9_5EDL7QPPMXLVOCDRHYVQM9U576TKO5BQ6POVOWZMC1VFT4YX0DH1Q9R_AMCXRS-528GOLW4WBVDX87VTQNHROCR3-9KIQ-V9RU3RZ7FOUU8KI3ZZQXWGV_B_2WODPGNUBE3TYM1LHXIM4EXOXDJKWPHSSCAOHH0EK50
delref HTTPS://NEWTAB.CLUB
delall %SystemRoot%\TEMP\JZKOEBITVPFCRZRE\BPOCLNPRX.EXE
delall %SystemRoot%\TEMP\INLCPPNPCTGODNIY\PEADILODD.EXE
delall %SystemDrive%\PROGRAMDATA\WINDOWSMENU\WESTAT.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\YKZSZAYRFZZSC\CVCVUWZ.DLL
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\DUOZAP.REG
delall %SystemDrive%\PROGRAM FILES (X86)\LWUEOSHGOBPOUROJZER\FADMHUO.DLL
delall %SystemDrive%\PROGRAMDATA\BQLRBDPGLIGGRXVB\GKUZXPL.WSF
delall %SystemDrive%\PROGRAM FILES (X86)\AOPBTRQYU\IEQXEO.DLL
delall %SystemDrive%\PROGRAM FILES (X86)\SJUIFJJOVMHU2\IINEUQNXPESOM.DLL
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\JOB-LIGHT.REG
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\RONCOF.REG
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\STATLIGHT.REG
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\TAMPSANTRAX.REG
delall %SystemDrive%\PROGRAMDATA\VOYASOLLAM\TEMPCOM.REG
delref HTTP://OVGORSKIY.RU
delref HTTP://WWW.SWEET-PAGE.COM/?TYPE=HP&TS=1414158211&FROM=COR&UID=SAMSUNGXHM321HI_S265J90B183093183093
apply
regt 27
deltmp
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE15\OLICENSEHEARTBEAT.EXE
delref {9F2B0085-9218-42A1-88B0-9F0E65851666}\[CLSID]
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL
delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL
delref {5AA199A0-1CED-43A5-9B85-3226086738A3}\[CLSID]
delref {DEF03232-9688-11E2-BE7F-B4B52FD966FF}\[CLSID]
delref %SystemDrive%\PROGRAM FILES\REMPL\REMSH.EXE
delref %Sys32%\EOSNOTIFY.EXE
delref %Sys32%\NOTIFIER.EXE
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS
delref %SystemRoot%\SYSWOW64\APPVETWCLIENTRES.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCLR.SYS
delref %SystemRoot%\SYSWOW64\W32TIME.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS
delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SMBDIRECT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL
delref %SystemRoot%\SYSWOW64\LSM.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {19916E01-B44E-4E31-94A4-4696DF46157B}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\[CLSID]
delref %Sys32%\DRIVERS\VMBUSR.SYS
delref %Sys32%\HVSICONTAINERSERVICE.DLL
delref %Sys32%\WINDOWSANYTIMEUPGRADERESULTS.EXE
delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL
delref %Sys32%\BLANK.HTM
delref SMART MOUNT SHELL EXTENSION\[CLSID]
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref TBS\[SERVICE]
delref %Sys32%\DRIVERS\USBAUDIO.SYS
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\MSMIRADISP.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL
delref %Sys32%\TETHERINGSETTINGHANDLER.DLL
delref %Sys32%\QUICKACTIONSPS.DLL
delref %Sys32%\IGFXOSP.DLL
delref %Sys32%\CHTADVANCEDDS.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemRoot%\SYSWOW64\TTLSEXT.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemRoot%\SYSWOW64\WBEM\KEYBOARDFILTERWMI.DLL
delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL
delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL
delref %SystemRoot%\SYSWOW64\PERCEPTIONSIMULATIONEXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERSTORE\FILEREPOSITORY\KI127176.INF_AMD64_86C658CABFB17C9C\IGFXEXPS32.DLL
delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL
delref %SystemRoot%\SYSWOW64\MAPSCSP.DLL
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\AZBJTDWTZIE\XYNZJYUIRU.EXE
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL
delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemRoot%\SYSWOW64\CONNECTEDSTORAGESERVICE.PROXYSTUB.DLL
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
;-------------------------------------------------------------
restart
|
| Цитата |
|---|
| This ransomware is still under analysis. Please refer to the appropriate topic for more information. Samples of encrypted files and suspicious files may be needed for continued investigation. Identified by ransomnote_filename: Dont_Worry.txt sample_extension: .UPS-<random16> Not enough information is public about AMBA. Please check back later. |
| Код |
|---|
;uVS v4.0.13 [http://dsrt.dyndns.org]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
zoo %SystemDrive%\PROGRAMDATA\81BAB96A-365C-4743-8348-D1FCDA09A124\B0160.EXE
zoo %SystemDrive%\PROGRAMDATA\MBVHOST.EXE
;------------------------autoscript---------------------------
delall %SystemDrive%\PROGRAMDATA\81BAB96A-365C-4743-8348-D1FCDA09A124\B0160.EXE
delall %SystemDrive%\PROGRAMDATA\MBVHOST.EXE
delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AOJOECKCMJGHLCHNNENFKBFLNDBEPJPK\8.23.0_0\ПОИСК И СТАРТОВАЯ — ЯНДЕКС
apply
deltmp
delref %SystemRoot%\SYSWOW64\HASPLMS.EXE
delref %SystemRoot%\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\FONTCACHE\FONTS\DOWNLOAD-1.TMP
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref %SystemRoot%\SYSWOW64\MAPSTOASTTASK.DLL
delref %SystemRoot%\SYSWOW64\MAPSUPDATETASK.DLL
delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVESTANDALONEUPDATER.EXE
delref %SystemDrive%\PROGRAMDATA\IOSTREAM.EXE
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS
delref %SystemRoot%\SYSWOW64\APPVETWCLIENTRES.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCLR.SYS
delref %SystemRoot%\SYSWOW64\W32TIME.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DXGMMS2.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\WINNAT.SYS
delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBUSR.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SMBDIRECT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\VMBKMCL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\REFS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\HVHOSTSVC.DLL
delref %SystemRoot%\SYSWOW64\LSM.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SYNTH3DVSC.SYS
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {BBACC218-34EA-4666-9D7A-C78F2274A524}\[CLSID]
delref {5AB7172C-9C11-405C-8DD5-AF20F3606282}\[CLSID]
delref {A78ED123-AB77-406B-9962-2A5D9D2F7F30}\[CLSID]
delref {F241C880-6982-4CE5-8CF7-7085BA96DA5A}\[CLSID]
delref {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\[CLSID]
delref {9AA2F32D-362A-42D9-9328-24A483E2CCC3}\[CLSID]
delref {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\[CLSID]
delref %Sys32%\DRIVERS\VMBUSR.SYS
delref %Sys32%\HVSICONTAINERSERVICE.DLL
delref %Sys32%\DRIVERS\UMDF\USBCCIDDRIVER.DLL
delref %Sys32%\BLANK.HTM
delref %Sys32%\DRIVERS\HDAUDADDSERVICE.SYS
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref TBS\[SERVICE]
delref %Sys32%\DRIVERS\USBAUDIO.SYS
delref VMMS\[SERVICE]
delref BROWSER\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %SystemDrive%\PROGRAM FILES\NVIDIA CORPORATION\DISPLAY\NVLICENSINGS.DLL
delref %Sys32%\TETHERINGSETTINGHANDLER.DLL
delref %Sys32%\QUICKACTIONSPS.DLL
delref %Sys32%\CHTADVANCEDDS.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemRoot%\SYSWOW64\TTLSEXT.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SPEECHRUNTIME.EXE
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemRoot%\SYSWOW64\WBEM\KEYBOARDFILTERWMI.DLL
delref %SystemRoot%\SYSWOW64\LOCATIONFRAMEWORK.DLL
delref %SystemRoot%\SYSWOW64\MAPSBTSVCPROXY.DLL
delref %SystemRoot%\SYSWOW64\PERCEPTIONSIMULATIONEXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\EAPPCFGUI.DLL
delref %SystemRoot%\SYSWOW64\MAPSCSP.DLL
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\AUTHHOSTPROXY.DLL
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemRoot%\SYSWOW64\RMSROAMINGSECURITY.DLL
delref %SystemRoot%\SYSWOW64\SYSTEMSETTINGSBROKER.EXE
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL
delref %SystemRoot%\SYSWOW64\SMARTSCREEN.EXE
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemRoot%\SYSWOW64\WIFICONFIGSP.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
delref %SystemDrive%\USERS\ANDREY\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVE.EXE
;-------------------------------------------------------------
restart
|
| Цитата |
|---|
| Андрей Калинин написал: К сожалению eset по каким то причинам при нажатии а кнопку удалить ( майнеры нашелся в оперативной памяти) написал что ошибка удаления |