Асиф Керимов,
по очистке системы выполните:

выполняем скрипт в uVS:
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
[code]

;uVS v4.0 RC1 [http://dsrt.dyndns.org]
;Target OS: NTv5.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

sreg

zoo %SystemDrive%\PROGRAM FILES\IOBIT\LIVEUPDATE\IOBITLAUNCHER.EXE
addsgn A7679B23526A4C7261D4C4B12DBDEB5476327809CFFAF76DE53A3A8F9083­19233F50C333C165F9C00B68DA42B9E9CD3A725B727055DA5845F0885BAB­0709A6FE 18 Program.Unwanted 7

chklst
delvir

deldirex %SystemDrive%\PROGRAM FILES\TENCENT\QQPCMGR\10.10.16434.218

deldirex %SystemDrive%\PROGRAM FILES\WISEENHANCE

deldirex %SystemDrive%\PROGRAM FILES\WISEENHANCE\BIN

deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\WINDOWSMANGERPROTECT

deldirex %SystemDrive%\PROGRAM FILES\GLOBALUPDATE\UPDATE\1.3.25.0

delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\BAIDU SECURITY\DUPLICATERECORD.JS
del %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\BAIDU SECURITY\DUPLICATERECORD.JS
delref %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-11.EXE
del %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-11.EXE
delref %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-4.EXE
del %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-4.EXE
delref %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-5.EXE
del %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-5.EXE
delref %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-6.EXE
del %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-6.EXE
delref %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-7.EXE
del %SystemDrive%\PROGRAM FILES\APPS HAT\36316498-B3D9-47DD-98AE-F60936FB007C-7.EXE
delref %SystemDrive%\PROGRAM FILES\CINEMAP-1.9CV28.01\7F266C12-9710-4C11-8845-DE59C71FBA36-11.EXE
del %SystemDrive%\PROGRAM FILES\CINEMAP-1.9CV28.01\7F266C12-9710-4C11-8845-DE59C71FBA36-11.EXE
delref %SystemDrive%\PROGRAM FILES\CINEMAP-1.9CV28.01\7F266C12-9710-4C11-8845-DE59C71FBA36-6.EXE
del %SystemDrive%\PROGRAM FILES\CINEMAP-1.9CV28.01\7F266C12-9710-4C11-8845-DE59C71FBA36-6.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\DESKTOP\ITOOLS_3.2.1.0_RUS\ITOOLS 3.2.1.0 RUS\ITOOLSDAEMON.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\USER\DESKTOP\ITOOLS_3.2.1.0_RUS\ITOOLS 3.2.1.0 RUS\ITOOLSDAEMON.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\PKEISIJ.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\PKEISIJ.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\HOSTINSTALLER\3490192065_INSTALLCUBE.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\HOSTINSTALLER\3490192065_INSTALLCUBE.EXE
delref %SystemDrive%\PROGRAM FILES\IOBIT\IOBIT UNINSTALLER\UNINSTALLEXPLORER32.DLL
del %SystemDrive%\PROGRAM FILES\IOBIT\IOBIT UNINSTALLER\UNINSTALLEXPLORER32.DLL
delref {5C255C8A-E604-49B4-9D64-90988571CECB}\[CLSID]
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\MAIL.RU\SPUTNIK\IESEARCHPLUGIN.DLL
del %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\MAIL.RU\SPUTNIK\IESEARCHPLUGIN.DLL
delref %Sys32%\TSSK.SYS
del %Sys32%\TSSK.SYS
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBMKCKGPGEKMANIPELFIDLHMKFCJICION%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\SKYPESETUPFULLXP.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\SKYPESETUPFULLXP.EXE
apply

regt 27
; WiseEnhance
exec C:\Program Files\WiseEnhance\WiseEnhanceUn.exe OFS_
deltmp
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\DROPBOX\BIN\DROPBOXEXT.28.DLL
delref %SystemDrive%\PROGRAM FILES\BAIDU SECURITY\BAIDU ANTIVIRUS\5.4.3.148966.0\BAVSHX.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MAIL.RU\AGENT\MRA\DLL\MRAMENU.DLL
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref %SystemDrive%\PROGRAM FILES\CYBERLINK\POWERDVD8\NAVFILTER\HDDVDNAV.AX
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {5645E0E7-FC12-43BF-A6E4-F9751942B298}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref %SystemRoot%\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\
delref %SystemDrive%\PROGRAM FILES\MAGICPLUS\MAGICPLUS.EXE
delref %Sys32%\BLANK.HTM
delref {42071714-76D4-11D1-8B24-00A0C9068FF3}\[CLSID]
delref {764BF0E1-F219-11CE-972D-00AA00A14F56}\[CLSID]
delref {853FE2B1-B769-11D0-9C4E-00C04FB6C6FA}\[CLSID]
delref {FAC3CBF6-8697-43D0-BAB9-DCD1FCE19D75}\[CLSID]
delref {B1883831-F0D8-4453-8245-EEAAD866DD6E}\[CLSID]
delref %Sys32%\DRIVERS\LGANDNETDIAG.SYS
delref %Sys32%\DRIVERS\LGANDNETMODEM.SYS
delref %SystemDrive%\PROGRAM FILES\BLUESTACKS\HD-SERVICE.EXE
delref %SystemDrive%\PROGRAM FILES\BLUESTACKS\HD-HYPERVISOR-X86.SYS
delref %SystemDrive%\PROGRAM FILES\BLUESTACKS\HD-LOGROTATORSERVICE.EXE
delref %SystemDrive%\PROGRAM FILES\BLUESTACKS\HD-UPDATERSERVICE.EXE
delref %Sys32%\DRIVERS\CHANGER.SYS
delref %Sys32%\DRIVERS\EW_HWUSBDEV.SYS
delref %Sys32%\DRIVERS\EW_USBENUMFILTER.SYS
delref %SystemRoot%\GDRV.SYS
delref %Sys32%\DRIVERS\EW_JUCDCACM.SYS
delref %Sys32%\DRIVERS\EW_JUCDCECM.SYS
delref %Sys32%\DRIVERS\EW_JUBUSENUM.SYS
delref %Sys32%\DRIVERS\EW_JUEXTCTRL.SYS
delref %Sys32%\DRIVERS\I2OMGMT.SYS
delref %Sys32%\DRIVERS\LBRTFDC.SYS
delref %Sys32%\DRIVERS\LEUSBSER.SYS
delref %Sys32%\DRIVERS\MASSFILTER.SYS
delref %Sys32%\DRIVERS\NETAAPL.SYS
delref %Sys32%\DRIVERS\PCIDUMP.SYS
delref %Sys32%\DRIVERS\PDCOMP.SYS
delref %Sys32%\DRIVERS\PDFRAME.SYS
delref %Sys32%\DRIVERS\PDRELI.SYS
delref %Sys32%\DRIVERS\PDRFRAME.SYS
delref %SystemDrive%\PROGRAM FILES\TENCENT\QQPCMGR\10.10.16434.218\QMUDISK.SYS
delref %SystemDrive%\PROGRAM FILES\TENCENT\QQPCMGR\10.10.16434.218\TS888.SYS
delref %SystemDrive%\PROGRAM FILES\WISEENHANCE\UPDATEWISEENHANCE.EXE
delref %Sys32%\DRIVERS\USBAAPL.SYS
delref %SystemDrive%\PROGRAM FILES\WISEENHANCE\BIN\UTILWISEENHANCE.EXE
delref %Sys32%\DRIVERS\WDICA.SYS
delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\WINDOWSMANGERPROTECT\PROTECTWINDOWSMANAGER.EXE
delref %Sys32%\DRIVERS\ZTEUSBMDM6K.SYS
delref %Sys32%\DRIVERS\ZTEUSBNMEA.SYS
delref %Sys32%\DRIVERS\ZTEUSBSER6K.SYS
delref %Sys32%\DRIVERS\{04149C3D-8572-400F-84EF-5AA7E85721A9}T.SYS
delref %Sys32%\DRIVERS\{1F504CCC-2549-476D-9244-B03A2F407980}T.SYS
delref %Sys32%\DRIVERS\{2C976A7F-DBDC-4756-870F-F6D183FE7A7E}GT.SYS
delref %Sys32%\DRIVERS\{2C976A7F-DBDC-4756-870F-F6D183FE7A7E}T.SYS
delref %Sys32%\DRIVERS\{79927C88-3AD2-4CC2-B84E-7C2DB334ABAB}T.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\DROPBOX\BIN\DROPBOX.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\DROPBOX\UPDATE\1.3.27.33\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.25.5\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.23.9\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.27.5\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.26.9\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.149\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.145\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.2.183.39\GOOPDATE.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.25.3\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.28.1\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.24.7\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.153\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.25.11\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.24.15\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.165\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.22.3\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\DROPBOX\UPDATE\1.3.27.29\PSUSER.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.22.5\PSUSER.DLL
delref %SystemDrive%\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\IDMIECC.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.22.3\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\IDMFSA.DLL
delref %SystemDrive%\DOCUME~1\USER\MYDOCU~1\LAZYPR~1.1_B\LAZYPR~1.1BE\PLUGIN\WINDOW.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.145\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.115\PSMACHINE.DLL
delref D:\CHECKVER.OCX
delref %Sys32%\EAPA3HST.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.22.5\PSMACHINE.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\LAZYPRESSINGV6.2.1+BETA\LAZYPRESSINGV6.2.1
delref %SystemDrive%\PROGRAM FILES\MESSENGER\MSGSC.DLL
delref %SystemDrive%\PROGRAM FILES\SAMSUNG\KIES3\EXTERNAL\SIMPLEPROVIDERS21.DLL
delref %SystemDrive%\DOCUME~1\USER\MYDOCU~1\LAZYPR~1.1_B\LAZYPR~1.1BE\PLUGIN\SYS.DLL
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\APPLICATION DATA\MAIL.RU\AGENT\MRA\DLL\MRAINPLACEVIEWER.DLL
delref %SystemDrive%\DOCUME~1\USER\MYDOCU~1\LAZYPR~1.1_B\LAZYPR~1.1BE\PLUGIN\REGDLL.DLL
delref D:\DRIVE~1B.OCX
delref %SystemDrive%\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\DOWNLWITHIDM.DLL
delref %SystemDrive%\PROGRAM FILES\TENCENT\QQPCMGR\10.10.16434.218\TAOFRAME.EXE
delref %SystemDrive%\DOCUME~1\USER\LOCALS~1\TEMP\HYD516.TMP.1487854983\HTA\3RDPARTY\FS.OCX
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.165\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\IDMGETALL.DLL
delref %SystemDrive%\DOCUME~1\USER\MYDOCU~1\LAZYPR~1.1_B\LAZYPR~1.1BE\PLUGIN\FILE.DLL
delref %SystemDrive%\PROGRAM FILES\WISEENHANCE\BIN\{79927C88-3AD2-4CC2-B84E-7C2DB334ABAB}.DLL
delref %Sys32%\EAPAHOST.DLL
delref %SystemDrive%\PROGRAM FILES\WINDOWS LIVE\MESSENGER\MSNMSGR.EXE
delref %SystemDrive%\PROGRAM FILES\CYBERLINK\POWERDVD8\AUDIOFILTER\COMTRUSURROUNDXT.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.153\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\QUALCOMM\QPST\BIN\DOWNLOAD.EXE
delref %SystemDrive%\PROGRAM FILES\BAIDU SECURITY\BAIDU ANTIVIRUS\5.4.3.148966.0\INTELLNODISTURB.DLL
delref %SystemDrive%\PROGRAM FILES\QUALCOMM\QPST\BIN\QPSTCONFIG.EXE
delref %SystemDrive%\DOCUME~1\USER\LOCALS~1\TEMP\HEXCMP 2 KEYGEN__10924_I1459451763_IL1066864.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\APPLICATION DATA\YANDEX\BROWSERMANAGER\BROWSERMANAGERSHOW.EXE
delref %SystemDrive%\PROGRAM FILES\TENCENT\QQPCMGR\10.10.16434.218\UDISKSHELLEXT.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.23.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.149\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\MESSENGER\MSMSGS.EXE
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\INTERNET DOWNLOAD MANAGER\IDMAN.EXE
delref %Sys32%\NVCUVENC.DLL
delref %SystemDrive%\PROGRAM FILES\BAKCELL 3G DATA CARD\BIXML.DLL
delref %SystemDrive%\DOCUME~1\USER\MYDOCU~1\LAZYPR~1.1_B\LAZYPR~1.1BE\LAZYPR~1.EXE
delref %Sys32%\AKELFILES\PLUGS\SCRIPTS.DLL
delref %SystemDrive%\PROGRAM FILES\GLOBALUPDATE\UPDATE\1.3.25.0\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.15\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\SAMSUNG\KIES3\EXTERNAL\SYNCHRONIZATION21.DLL
delref %SystemDrive%\PROGRAM FILES\SAMSUNG\KIES3\EXTERNAL\METASTORE21.DLL
delref %SystemDrive%\PROGRAM FILES\SAMSUNG\KIES3\EXTERNAL\MSFDB.DLL
delref %Sys32%\MACROMED\FLASH\FLASHUTIL32_18_0_0_232_PEPPER.EXE
delref E:\LGAUTORUN.EXE
delref E:\INSTALL.EXE
delref E:\AUTORUN.EXE
delref E:\SETUP.EXE
delref G:\LENOVO_SUITE.EXE
delref E:\LENOVO_SUITE.EXE
delref E:\SOURCES\SPERR32.EXE
delref {11111111-1111-1111-1111-110411851159}\[CLSID]
delref {29B6CFD5-0064-411A-8C42-9890C83F9921}\[CLSID]
delref {7558B7E5-7B26-4201-BEDB-00D5FF534523}\[CLSID]
delref {D4BE399F-CFDF-462F-B234-2E3A62CFF5A8}\[CLSID]
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\LAZPRESS.EXE
delref %SystemDrive%\PROGRAM FILES\LUCKYTAB\LUCKYTAB.EXE
delref %SystemDrive%\PROGRAM FILES\ZONA\ZONA.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\AKELPAD.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\USER\MY DOCUMENTS\AKELFILES\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES\CLASHFARMER\CLASHFARMER.EXE
delref D:\MINIPRO\MINIPRO.EXE
delref D:\MINIPRO\UNINSTALL.EXE
delref D:\MINIPRO\USBDRVINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES\UNINSTALL TOOL\UTOOL.URL
areg

;-------------------------------------------------------------

[/code]
перезагрузка, пишем о старых и новых проблемах.
------------

Асиф Керимов,
если необходима помощь в очистке системы, добавьте образ автозапуска системы.

Альберт,
добавьте несколько зашифрованных файлов и readme*.txt в архиве в ваше сообщение.
по расшифровке придется ждать неопределенное время, когда она будет возможна.

по очистке системы выполните

выполняем скрипт в uVS:
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
[code]

;uVS v4.0b13 [http://dsrt.dyndns.org]
;Target OS: NTv6.3
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

sreg

deldirex %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\POKKI\ENGINE

delref %SystemDrive%\PROGRAM FILES (X86)\SHOPPERAMAISDABEST\SHOPPERAMAISDABEST_HELPER_SERVICE.EXE
del %SystemDrive%\PROGRAM FILES (X86)\SHOPPERAMAISDABEST\SHOPPERAMAISDABEST_HELPER_SERVICE.EXE
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref %SystemDrive%\PROGRAM FILES (X86)\EXSTRACOUPON\KRUSAJYDV6SYB0.X64.DLL
del %SystemDrive%\PROGRAM FILES (X86)\EXSTRACOUPON\KRUSAJYDV6SYB0.X64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BUITSAVER\X6WVUYGN4G9OSS.X64.DLL
del %SystemDrive%\PROGRAM FILES (X86)\BUITSAVER\X6WVUYGN4G9OSS.X64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\EXSTRACOUPION\KCL5WKRP7M0GYF.X64.DLL
del %SystemDrive%\PROGRAM FILES (X86)\EXSTRACOUPION\KCL5WKRP7M0GYF.X64.DLL
delref HTTP://WWW.ISTARTSURF.COM/WEB/?TYPE=DS&TS=1431627290&Z=0F44B83CAE55A73CF810501G9Z1CCGDQ9OAM­1O6BEW&FROM=FACE&UID=WDCXWD10EZEX-60M2NA0_WD-WCC3FEJS9JK1S9JK1&Q={SEARCHTERMS}
delref %Sys32%\DRIVERS\{11944E07-3E46-4956-B8C7-7E52C7A44C1D}GW64.SYS
del %Sys32%\DRIVERS\{11944E07-3E46-4956-B8C7-7E52C7A44C1D}GW64.SYS
delref %Sys32%\DRIVERS\{36ED28A4-AC0A-4653-91FF-10BEB4246550}W64.SYS
del %Sys32%\DRIVERS\{36ED28A4-AC0A-4653-91FF-10BEB4246550}W64.SYS
delref %Sys32%\DRIVERS\{3F1219DF-4A4D-40A3-9537-F2A95F4016B3}W64.SYS
del %Sys32%\DRIVERS\{3F1219DF-4A4D-40A3-9537-F2A95F4016B3}W64.SYS
delref %Sys32%\DRIVERS\{42F8F729-2FA8-44BB-B01A-28C57A8162C7}GW64.SYS
del %Sys32%\DRIVERS\{42F8F729-2FA8-44BB-B01A-28C57A8162C7}GW64.SYS
delref %Sys32%\DRIVERS\{6DD55E9A-3D06-4D70-B5E7-05FC3E0A3D66}W64.SYS
del %Sys32%\DRIVERS\{6DD55E9A-3D06-4D70-B5E7-05FC3E0A3D66}W64.SYS
delref %Sys32%\DRIVERS\{848705A5-8A27-403E-9B59-732D0608BCBC}W64.SYS
del %Sys32%\DRIVERS\{848705A5-8A27-403E-9B59-732D0608BCBC}W64.SYS
delref %Sys32%\DRIVERS\{AB573EF7-ACD0-4715-A5C0-420D2EE2CD93}W64.SYS
del %Sys32%\DRIVERS\{AB573EF7-ACD0-4715-A5C0-420D2EE2CD93}W64.SYS
delref %Sys32%\DRIVERS\{E2590817-40CA-4D03-8E1F-67FD8517BAE9}GW64.SYS
del %Sys32%\DRIVERS\{E2590817-40CA-4D03-8E1F-67FD8517BAE9}GW64.SYS
delref %Sys32%\DRIVERS\{EB01AED1-BBA3-4E72-8323-A77BB027B1D4}W64.SYS
del %Sys32%\DRIVERS\{EB01AED1-BBA3-4E72-8323-A77BB027B1D4}W64.SYS
delref HTTP://WWW.ISTARTSURF.COM/WEB/?UTM_SOURCE=B&UTM_MEDIUM=FACE&UTM_CAMPAIGN=INSTALL_IE&UTM_CON­TENT=DS&FROM=FACE&UID=WDCXWD10EZEX-60M2NA0_WD-WCC3FEJS9JK1S9JK1&TS=1431627312&TYPE=DEFAULT&Q={SEARCHTERMS}
delref %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\PAY-BY-ADS\YAHOO! SEARCH\1.4.2.5\DSRLTE.EXE
del %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\PAY-BY-ADS\YAHOO! SEARCH\1.4.2.5\DSRLTE.EXE
delref %SystemDrive%\PROGRAMDATA\WINDOWS\CSRSS.EXE
del %SystemDrive%\PROGRAMDATA\WINDOWS\CSRSS.EXE
delref %SystemDrive%\PROGRAMDATA\SERVICES\CSRSS.EXE
del %SystemDrive%\PROGRAMDATA\SERVICES\CSRSS.EXE
delref %SystemDrive%\PROGRAMDATA\CSRSS\CSRSS.EXE
del %SystemDrive%\PROGRAMDATA\CSRSS\CSRSS.EXE
delref %SystemDrive%\PROGRAMDATA\DRIVERS\CSRSS.EXE
del %SystemDrive%\PROGRAMDATA\DRIVERS\CSRSS.EXE
del %SystemDrive%\IEXPLORE.BAT
delref HTTP:\\SEARCHVAP.RU
del %SystemDrive%\LAUNCHER.BAT
apply

regt 28
regt 29

deltmp
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\IOBITUNINSTALER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\DRIVER BOOSTER\DRIVERBOOSTER.EXE
delref A9A33436-678B-4C9C-A211-7CC38785E79D\[CLSID]
delref 752073A1-23F2-4396-85F0-8FDB879ED0ED\[CLSID]
delref %SystemDrive%\PROGRA~3\6CFDDB19\1AF6378C.DLL
delref %SystemRoot%\SYSWOW64\COMPMGMTLAUNCHER.EXE
delref %SystemRoot%\SYSWOW64\DRIVERS\MRXSMB.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\USBXHCI.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\SRV2.SYS
delref %SystemRoot%\SYSWOW64\RDPCORETS.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\HTTP.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\TCPIP.SYS
delref %SystemRoot%\SYSWOW64\UMPOEXT.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\DMVSC.SYS
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\SPACEPORT.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\FVEVOL.SYS
delref %SystemRoot%\SYSWOW64\DRIVERS\AFD.SYS
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.DLL
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {0CC4D9CE-29FF-4675-94D3-9E44E87FE06F}\[CLSID]
delref {102AC6CF-0B45-4471-B90B-23439C3C52BA}\[CLSID]
delref {19916E01-B44E-4E31-94A4-4696DF46157B}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {4B148D50-1DE3-4FED-9C28-EFAA385D54DA}\[CLSID]
delref {635D54A8-7C31-4C34-9FEA-FF8C5EE787E4}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {C414535E-B440-4A15-B8A5-0926A76699A5}\[CLSID]
delref {9DE5BD99-A5C0-4A88-9A26-D19C2826E4FA}\[CLSID]
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\44.0.2403.107\INSTALLER\CHRMSTP.EXE
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\POKKI\ENGINE\LAUNCH­ER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\DDIGIISAVER\09F8RAVJYA8KK0.X64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\DEIGISAVER\8PH8OTGHZXZI0F.X64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\SAVEROEXTTENSION\ZBD65HHGXOAUMS.X64.DLL
delref %Sys32%\BLANK.HTM
delref {CCFE56EE-C7DE-44EE-A160-4553A5A912C9}\[CLSID]
delref %Sys32%\DRIVERS\75211322.SYS
delref APPMGMT\[SERVICE]
delref TBS\[SERVICE]
delref %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\SERVER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\EDU APP\BIN\42F864.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemRoot%\SYSWOW64\AEPROAM.DLL
delref %SystemRoot%\SYSWOW64\RSTRUI.EXE
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.25.11\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\ACRORD32INFO.EXE
delref %SystemRoot%\SYSWOW64\WPCCPL.DLL
delref %SystemDrive%\PROGRAM FILES\NVIDIA CORPORATION\INSTALLER2\INSTALLER.{31F4D53D-4A95-4365-B5DE-7C364ED980F4}\NVI2.DLL
delref %SystemRoot%\SYSWOW64\BAK.DLL
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
delref %SystemRoot%\SYSWOW64\INETSRV\IISRSTAS.EXE
areg

;-------------------------------------------------------------

[/code]
перезагрузка, пишем о старых и новых проблемах.
------------

[QUOTE]Виктор Астанин написал:
[URL=https://forum.esetnod32.ru/user/22/]santy[/URL] подскажите. возможно ли расшифровать файл зашифрованный *.crypt ( зашифровали 28 апреля)

Публикую образец файлов[/QUOTE]
Виктор,
это не Crysis, другой шифратор.
попробуйте более точно определить использую сервис IDR
https://id-ransomware.malwarehunterteam.com/index.php
желательно оба файла загрузить для идентификации: записку о выкупе, если есть такая, и один зашифрованный файл.

если есть пара: зашифрованный - чистый файл, добавьте в архиве на форум в ваше сообщение.

Антон,
файлов шифратора уже нет в системе.

скачайте актуальную версию uVS 4.0.13b
http://chklst.ru/data/uVS%20latest/uvs_latest.zip

по очистке системы выполните:

выполняем скрипт в uVS:
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
[code]

;uVS v4.0b13 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

deldirex %SystemDrive%\USERS\HATEYOU\APPDATA\LOCALLOW\UNITY\WEBPLAYER­\LOADER

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DABLPCIKJMHAMJANPIBKCCDMPOEKJIGJA%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGBJEIEKAHKLBGBFCCOHIPINHGAADIJAD%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGDLJKKMGHDKCKHAOGAEMGBGDFOPHKFCO%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DODIJCGAFKHPOBJLNFDGIACPDENPMBGME%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPHKDCINMMLJBLPNKOHLIPAIODLONPINF%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPMPOAAHLECCAIBBHFJFIMIGEPMFMMBBK%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\CHROME\USER­ DATA\PROFILE 2\EXTENSIONS\CPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK\2.0.4.14_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\CHROME\USER­ DATA\PROFILE 2\EXTENSIONS\GBJEIEKAHKLBGBFCCOHIPINHGAADIJAD\2.0.3.14_2\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\CHROME\USER­ DATA\PROFILE 2\EXTENSIONS\PHKDCINMMLJBLPNKOHLIPAIODLONPINF\11.0.3_0\ПОИСК MAIL.RU
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO%26INSTALLSOURCE%3D­ONDEMAND%26UC
apply

regt 27
; Bonjour
deltmp
delref %SystemDrive%\PROGRAM FILES (X86)\ASUS\EPU-4 ENGINE\FOURENGINE.EXE
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\AV\AVAST! ANTIVIRUS\BACKUP.EXE
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\GOOG­LEUPDATE.EXE
delref %SystemDrive%\USERS\HATEYOU\DOWNLOADS\CHROMEINSTALL-8U31.EXE
delref %SystemDrive%\USERS\HATEYOU\DOWNLOADS\SL-6640\SETUP.EXE
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\CHROME\APPL­ICATION\CHROME.EXE
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D017600}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D018C00}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D020107}\[CLSID]
delref {CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\[CLSID]
delref {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBC}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {EBA7A1E6-E69D-4BA5-B291-95782A004604}\[CLSID]
delref %SystemRoot%\SYSWOW64\WIN32K.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\1.118.0\NPESNLAUNCH.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\1.140.0\NPESNLAUNCH.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\2.1.7\NPESNLAUNCH.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\STARDOCK\OBJECT DESKTOP\ICONPACKAGER\IPCPL.CPL
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\AIMP3\MODULES\AIMP_MENU64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\AIMP3\MODULES\AIMP_MENU32.DLL
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {2DEDD2C9-928E-4442-9417-769C969973B6}\[CLSID]
delref %SystemDrive%\PROGRA~2\IMAGE-~1\FLSTUD~1\SYSTEM\PLUGIN\DXI\FLSTUD~2.DLL
delref %SystemDrive%\PROGRA~2\IMAGE-~1\FLSTUD~1\SYSTEM\PLUGIN\DXI\FLSTUD~1.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\VIDEOMEMORYRENDERFILTER.AX
delref {307A6C42-0000-0010-8000-00AA00389B71}\[CLSID]
delref %Sys32%\MSSPELLCHECKINGFACILITY.DLL
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %Sys32%\DRIVERS\DGDERDRV.SYS
delref %Sys32%\DRIVERS\EAGLEX64.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\MAINTENANCESERVICE.EXE
delref %Sys32%\DRIVERS\RDVGKMD.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.23.9\PSUSER_64.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.7\PSUSER_64.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.11\PSUSER_64.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.15\PSUSER_64.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.135\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.23.9\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.99\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.149\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.145\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.115\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.79\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.7\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.11\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.165\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.153\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.123\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.15\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.111\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.22.5\PSUSER.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\ROAMING\YANDEX\YANDEXDIS­K\WOW64\YANDEXDISKSHELLEXT-4602.DLL
delref %SystemDrive%\USERS\HATEYOU\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.22.3\PSUSER.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\ASIO4ALL V2\ASIO4ALL64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\NOKIA\NOKIA PC SUITE 7\X64\MAPIHELPERPROXY.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.26.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRA~2\AIMP3\AIMP3.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\ACCESSIBLEMARSHAL.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL
delref E:\CHECKVER.OCX
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\ASIO4ALL V2\ASIO4ALL.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.27.5\PSMACHINE.DLL
delref E:\DRIVE~16.OCX
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\NVIDIA CORPORATION\INSTALLER2\INSTALLER.{AD78BCE9-5964-4F13-B5C9-7DF237C5A253}\NVI2.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.29.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\PLUGINS\FRUITY\EFFECTS\ZGAMEEDITOR VISUALIZER\MEDIAVIDEODECODER.DLL
delref G:\HBCD\HBCDMENU.EXE
delref G:\AUTORUN.EXE
delref F:\AUTORUN.EXE
delref {42262EC6-50E2-43B1-B0EF-A07DEEF7E241}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D016E00}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D017A00}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D020102}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D020103}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D020300}\[CLSID]
delref {FFE66D00-A56A-4F7F-81D7-4A28C5816D6C}\[CLSID]
delref %SystemDrive%\USERS\HATEYOU\LOCAL SETTINGS\APPLICATION DATA\LANCET CHAT\LANCETCHAT.EXE
delref D:\GAMES\WARTHUNDER\UNINS000.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\ZZIMA\FORSAKENWORLD\PATCHER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\THE KMPLAYER\KMPLAYER.EXE
delref D:\GAMES\AIONLEGENDUPDATER_RUS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\FL (EXTENDED MEMORY).EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\FL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\SYSTEM\INTERNET\FL STUDIO ONLINE.URL
delref %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\FL STUDIO 10\UNINSTALL.EXE
;-------------------------------------------------------------

restart
[/code]
перезагрузка, пишем о старых и новых проблемах.
------------

Антон,
во первых: не надо исполнять скрипты, которые написаны не для вас,
во-вторых: добавьте образ автозапуска с вашей машины.

Michael Gillespie‏:
Dharma #Ransomware may have a new extension: ".onion". Spotted "http://config.sys.id -66813FE4.[[email protected]].onion" on IDR

https://twitter.com/demonslay335/status/852959798815490048

[QUOTE]Денис Максимов написал:
Здравствуйте! Поймали шифровальщик :-( В аттаче образ автозапуска, зашифрованные файлы и файл с кодом для расшифровки. Помогите, пожалуйста!  [/QUOTE]
судя по образу автозапуска система уже очищена от файлов шифратора.
сохраните документы из важных каталогов на отдельный носитель, возможно когда нибудь будет расшифровка документов no_more_ransom

Роман Иванов,

выполняем скрипт в uVS:
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
[code]

;uVS v4.0b13 [http://dsrt.dyndns.org]
;Target OS: NTv5.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

hide %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\APPLICATION DATA\YANDEX\UPDATER\PRAETORIAN.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\TEMP\RAD411EF.TMP
addsgn A7679B1BB9CA4C720BBCB61139C8ED10B5CDA5F64EBFF37D85C3C557595D­34A0A0D7CFDE7BB91C34C7D5D79F46654105682FAF2B553156A720630572­C757DD66 8 tr.Carberp 7

addsgn A7679B1BB9CA4C720BBCB61139C8ED10B5CDA5F64EBFF37D85C3C557595D­34A0A0D7CFDE7BB91C34C7D5D79F46654105682FAF2B553156A720630572­C757DD66 8 Ransom:Win32/Troldesh 7

zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\TEMP\RADC4DEF.TMP
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\O7K3AHX1\2404[1].EXE
chklst
delvir

setdns Подключение по локальной сети\4\{30C0D7AF-5A22-4B3B-BD8C-07FCA19776AD}\8.8.8.8,8.8.4.4
deldirex %SystemDrive%\PROGRAM FILES\360\360 INTERNET SECURITY

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCNCGOHEPIHCEKKLOKHBHIBLHFCMIPBDH%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DHCHMLJAAGNCPKOJNAKLLLMCEBPHKCHIP%26INSTALLSOURCE%3D­ONDEMAND%26UC
delref .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\JWGKVSQ.VMX
apply

; Java™ 6 Update 6
exec MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060} /quiet
deltmp
delref {100BD527-7304-4B7F-BEE2-26D97B04EBA4}\[CLSID]
delref {240629A2-EDE1-4FE8-B8BB-D4974A9B9600}\[CLSID]
delref {73FCA462-9BD5-4065-A73F-A8E5F6904EF7}\[CLSID]
delref {0414023D-89C7-4A7F-B05E-0A9E9E25162D}\[CLSID]
delref {37B77C6A-195D-4061-A02D-627D5E1F7390}\[CLSID]
delref %SystemDrive%\PROGRAM FILES\ARCSOFT\PHOTOIMPRESSION 4\EZRGB24.AX
delref {42C8B699-7AAD-44E6-9DCD-78D415654C35}\[CLSID]
delref {79623F3B-FE2E-4870-B130-9F374BFC5A09}\[CLSID]
delref {7EAAEF63-73E6-494E-9A47-72B67E30850E}\[CLSID]
delref {821514BA-3DA2-43F9-B27F-E009F7E2086D}\[CLSID]
delref {9E1504B9-B281-4ACC-A919-AA1D919E5B50}\[CLSID]
delref {C43BA19F-5687-40F6-86C9-64B93A09A58F}\[CLSID]
delref {C4DBAA2A-3E92-4736-ADF9-131E208C8DAD}\[CLSID]
delref {F4C6E300-03C7-4B51-B0F3-173950268744}\[CLSID]
delref {FDB93713-AF4F-47C7-A3E0-36A95579D0F7}\[CLSID]
delref {91397D20-1446-11D4-8AF4-0040CA1127B6}\[CLSID]
delref %SystemDrive%\PROGRAM FILES\JAVA\JRE1.6.0_06\BIN\SSV.DLL
delref %SystemDrive%\PROGRAM FILES\JAVA\JRE1.6.0_06\BIN\NPJPI160_06.DLL
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {19916E01-B44E-4E31-94A4-4696DF46157B}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBC}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID]
delref %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\BV7DRTCQ.DEFAULT\EXTENSIONS\[email protected]\INSTALL.RDF
delref %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИНИСТРАТОР\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\UNMVEXVY.SERVER\EXTENSIONS\[email protected]
delref %Sys32%\BLANK.HTM
delref {764BF0E1-F219-11CE-972D-00AA00A14F56}\[CLSID]
delref {853FE2B1-B769-11D0-9C4E-00C04FB6C6FA}\[CLSID]
delref {85BBD920-42A0-1069-A2E4-08002B30309D}\[CLSID]
delref {87D62D94-71B3-4B9A-9489-5FE6850DC73E}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\[CLSID]
delref {F5175861-2688-11D0-9C5E-00AA00A45957}\[CLSID]
delref {08165EA0-E946-11CF-9C87-00AA005127ED}\[CLSID]
delref {E3A8BDE6-ABCE-11D0-BC4B-00C04FD929DB}\[CLSID]
delref {E8BB6DC0-6B4E-11D0-92DB-00A0C90C2BD7}\[CLSID]
delref {7D559C10-9FE9-11D0-93F7-00AA0059CE02}\[CLSID]
delref {E6CC6978-6B6E-11D0-BECA-00C04FD940BE}\[CLSID]
delref {D8BD2030-6FC9-11D0-864F-00AA006809D9}\[CLSID]
delref {7FC0B86E-5FA7-11D1-BC7C-00C04FD929DB}\[CLSID]
delref {E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\[CLSID]
delref {B1883831-F0D8-4453-8245-EEAAD866DD6E}\[CLSID]
delref {52B87208-9CCF-42C9-B88E-069281105805}\[CLSID]
delref %Sys32%\DRIVERS\50105312.SYS
delref %Sys32%\DRIVERS\65285166.SYS
delref %Sys32%\DRIVERS\69453332.SYS
delref %Sys32%\DRIVERS\CHANGER.SYS
delref %Sys32%\DRIVERS\CMUDAU.SYS
delref %Sys32%\DRIVERS\EWUSBNET.SYS
delref %Sys32%\DRIVERS\EW_HWUSBDEV.SYS
delref %Sys32%\DRIVERS\EW_USBENUMFILTER.SYS
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\GOOGLEUPDATE.EXE
delref %Sys32%\DRIVERS\EW_JUBUSENUM.SYS
delref %Sys32%\DRIVERS\EWUSBMDM.SYS
delref %Sys32%\DRIVERS\EWUSBDEV.SYS
delref %Sys32%\DRIVERS\I2OMGMT.SYS
delref %Sys32%\DRIVERS\LBRTFDC.SYS
delref %Sys32%\DRIVERS\MASSFILTER.SYS
delref %Sys32%\DRIVERS\MBAMSWISSARMY.SYS
delref %SystemDrive%\PROGRAM FILES\MCAFEE SECURITY SCAN\3.11.334\MCCHSVC.EXE
delref %Sys32%\NERO BACKITUP SCHEDULER 3.EXE
delref %Sys32%\DRIVERS\PCIDUMP.SYS
delref %Sys32%\DRIVERS\PDCOMP.SYS
delref %Sys32%\DRIVERS\PDFRAME.SYS
delref %Sys32%\DRIVERS\PDRELI.SYS
delref %Sys32%\DRIVERS\PDRFRAME.SYS
delref %Sys32%\DRIVERS\QUTMIPC.SYS
delref %Sys32%\DRIVERS\WDICA.SYS
delref %Sys32%\DRIVERS\ZTEUSBMDM6K.SYS
delref %Sys32%\DRIVERS\ZTEUSBNMEA.SYS
delref %Sys32%\DRIVERS\ZTEUSBSER6K.SYS
delref %Sys32%\DRIVERS\ZTEUSBVOICE.SYS
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.26.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.28.1\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.145\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.115\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.28.15\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.22.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRA~1\MICROS~2\OFFICE12\VVIEWER.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\PYTHON\PYTHON21\PYTHONW.EXE
delref %SystemDrive%\PROGRAM FILES\NANOSOFT\NORMACS 3.0 DEMO\NORMACS_API_DLG.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.27.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.79\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.111\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.165\PSMACHINE.DLL
delref I:\SETUP.EXE
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.153\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\SPYWARE TERMINATOR\SPYWARETERMINATOR.EXE
delref %SystemDrive%\PROGRAM FILES\SMART PANEL\SMAPANEL.EXE
delref %SystemDrive%\PROGRAM FILES\360\360 INTERNET SECURITY\SAFELIVE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.25.11\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.28.13\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.135\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.23.9\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.69\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.149\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\EPSON\PHOTO PRINT\EPPAPP.EXE
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.25.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\NANOSOFT\NORMACS 3.0 DEMO\NORMACS_API.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.123\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\NEWSOFT\PRESTO! BIZCARD ENG\BCR40.EXE
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.21.99\PSMACHINE.DLL
delref %Sys32%\MACROMED\FLASH\FLASHUTIL9F.EXE
delref %SystemDrive%\PROGRAM FILES\NANOSOFT\NORMACS 3.0 DEMO\NORMACSHLINK.EXE
delref %SystemDrive%\PROGRAM FILES\YANDEX\FASTDIAL\FASTDIAL.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.22.3\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.15\PSMACHINE.DLL
delref {CC59E0F9-7E43-44FA-9FAA-8377850BF205}\[CLSID]
delref E:\AUTORUN.EXE
delref E:\RUNCLUBSANDISK.EXE
delref E:\SETUPSNK.EXE
delref E:\INSTALL.EXE
delref E:\LAUNCHER.EXE
delref L:\AUTORUN.EXE
delref E:\TRANSCENDSERVICE(JF).EXE
delref {09900DE8-1DCA-443F-9243-26FF581438AF}\[CLSID]
delref {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\[CLSID]
delref {4248FE82-7FCB-46AC-B270-339F08212110}\[CLSID]
delref {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\[CLSID]
delref {8984B388-A5BB-4DF7-B274-77B879E179DB}\[CLSID]
delref {92780B25-18CC-41C8-B9BE-3C9C571A8263}\[CLSID]
delref {C93F72A2-2162-4BBA-A07A-F13663C297A6}\[CLSID]
delref {CCF151D8-D089-449F-A5A4-D9909053F20F}\[CLSID]
delref {E33CF602-D945-461A-83F0-819F76A199F8}\[CLSID]
;-------------------------------------------------------------

restart
[/code]
перезагрузка, пишем о старых и новых проблемах.
------------

@Азиз Гаджиев,
добавьте образ автозапуска системы
http://forum.esetnod32.ru/forum9/topic2687/