uVS: start.exe, текущий пользователь, меню, скрипты - выполнить скрипт из буфера обмена.
ПЕРЕД ВЫПОЛНЕНИЕМ СКРИПТА, ЗАКРЫТЬ БРАУЗЕРЫ!
ВНИМАНИЕ : По окончанию выполнения скрипта компьютер выполнит перезагрузку !
Код |
---|
;uVS v4.11 [http://dsrt.dyndns.org:8888] ;Target OS: NTv5.1 v400c OFFSGNSAVE ;------------------------autoscript--------------------------- deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\UNITY\WEBPLAYER\LOADER deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\UNITY\WEBPLAYER delref HTTP://CRASH-REPORTS.BROWSER.YANDEX.NET/SUBMIT delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DABLPCIKJMHAMJANPIBKCCDMPOEKJIGJA%26INSTALLSOURCE%3DONDEMAND%26UC delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\\LOCAL SETTINGS\APPLICATION DATA\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\[email protected] del %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\\LOCAL SETTINGS\APPLICATION DATA\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\[email protected] delref HTTP://SEARCH.LIVE.COM/RESULTS.ASPX?Q={SEARCHTERMS}&SRC={REFERRER:SOURCE?} delref HTTP://SEARCH.SWEETIM.COM/SEARCH.ASP?SRC=6&Q={SEARCHTERMS} delall %SystemDrive%\DOCUME~1\ADMIN\LOCALS~1\TEMP\PHQ15C.TMP delref HTTP://GO.MAIL.RU/DISTIB/EP/?PRODUCT_ID=%7B6AC6311B-CC33-42B7-AA5E-6416DE47E8C6%7D&GP=811010 delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\[email protected] del %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\[email protected] delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\[email protected] del %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\[email protected] delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\NPDPPLBICNMPOIGIDFDJADAMGFKILAAK\9.20_0\SAVEFROM.NET ПОМОЩНИК delref %11%\EAPAHOST.DLL delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO%26INSTALLSOURCE%3DONDEMAND%26UC delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLDGPJDIADOMHINPIMGCHMEEMBBGOJNJK%26INSTALLSOURCE%3DONDEMAND%26UC delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\STAGED\[email protected] del %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\EXTENSIONS\STAGED\[email protected] delref HTTP://MOIKRUG.RU/PERSONS/?CLID=193835&CHARSET=UTF-8&KEYWORDS={SEARCHTERMS}&SUBMITTED=1 delref HTTP://RU.WIKIPEDIA.ORG/WIKI/SPECIAL:SEARCH?SEARCH={SEARCHTERMS} delref HTTP://SEARCH.LIVE.COM/RESULTS.ASPX?Q={SEARCHTERMS}&SRC=IE-SEARCHBOX&FORM=IE8SRC delref HTTP://RU.SEARCH.YAHOO.COM/SEARCH?P={SEARCHTERMS}&FR=CHR-DEVICEVM&TYPE=STDVM delref HTTP://WEBALTA.RU/SEARCH?Q={SEARCHTERMS}&FROM=IE delref HTTP://WWW.GOOGLE.COM/CSE?CX=PARTNER-PUB-3794288947762788%3A4067623346&IE=UTF-8&Q={SEARCHTERMS}&SA=SEARCH&SITEURL=WWW.GOOGLE.COM%2FCSE%2FHOME%3FCX%3DPARTNER-PUB-3794288947762788%3A4067623346 delref HTTP://PRICE.RU/ENTER?FROM=OSS&PNAM={SEARCHTERMS} delref HTTP://SEARCH.QIP.RU/SEARCH?QUERY={SEARCHTERMS}&FROM=IE delref HTTP://WWW.DAEMON-SEARCH.COM/SEARCH?Q={SEARCHTERMS} delref HTTP://SEARCH.CONDUIT.COM/RESULTSEXT.ASPX?Q={SEARCHTERMS}&SEARCHSOURCE=4&CTID=CT1066435 delref HTTP://WWW.GOOGLE.RU/SEARCH?HL=RU&Q={SEARCHTERMS} delref HTTP://WWW.BING.COM/SEARCH?Q={SEARCHTERMS}&FORM=SPLBR2&PC=SPLH delref HTTP://GO.MAIL.RU/DISTIB/EP/?Q={SEARCHTERMS}&PRODUCT_ID=%7BB3CEA8B3-B5A4-4D61-AE97-777C630A0598%7D&GP=811014 delref HTTP://WEBALTA.RU/SEARCH delall %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\TEMP\7ZIPSFX.000\UINSTALL.EXE delall %SystemRoot%\TEMP\OPERA AUTOUPDATE\INSTALLER.EXE delref HTTP://SOCIALGAMES.SPLASHTOP.COM/GBSP/MB/?P=W delref HTTP://4GAME.RU/?PID=5113216 delref HTTP://WWW.CHUMBA.CH/CHUMBALUM-SOFT/FORUM/ delref HTTP://WWW.MILKSHAPE3D.COM/ delref HTTP://WWW.MILKSHAPE3D.COM/MS3D/REGISTER.HTML delref HTTP://WWW.THEHUNTERWIKI.COM/GO/?GETTING_STARTED delref HTTP://WWW.THEHUNTER.COM/ apply ;------------------------------------------------------------- deltmp restart ;---------command-block--------- delref HTTPS://YANDEX.RU/SEARCH/?WIN=424&CLID=41141&TEXT={SEARCHTERMS} delref {426F6A6F-FEF8-4A5B-8DDC-099E7499EF50}\[CLSID] delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID] delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID] delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID] delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID] delref {75579960-3DAF-4389-9CFA-C2BB270C91E6}\[CLSID] delref {CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\[CLSID] delref {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBC}\[CLSID] delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID] delref %SystemDrive%\PROGRAM FILES\KAT MP3 RECORDER\KAT MP3 RECORDER.EXE delref %Sys32%\BLANK.HTM delref {764BF0E1-F219-11CE-972D-00AA00A14F56}\[CLSID] delref {853FE2B1-B769-11D0-9C4E-00C04FB6C6FA}\[CLSID] delref {FAC3CBF6-8697-43D0-BAB9-DCD1FCE19D75}\[CLSID] delref {A8065B9E-193F-4797-B62D-8F6321E7FCCB}\[CLSID] delref PEVSYSTEMSTART\[SERVICE] delref %Sys32%\DRIVERS\PROCEXP90.SYS delref %Sys32%\DRIVERS\AMBFILT.SYS delref %SystemDrive%\PROGRAM FILES\MULTI PASSWORD RECOVERY\BLOCK_READER.SYS delref %Sys32%\DRIVERS\CHANGER.SYS delref %Sys32%\DRIVERS\EWUSBNET.SYS delref %SystemRoot%\GDRV.SYS delref %SystemDrive%\PROGRAM FILES\GARENA CLASSIC\SAFEDRV.SYS delref %Sys32%\DRIVERS\EW_JUBUSENUM.SYS delref %Sys32%\DRIVERS\EWUSBMDM.SYS delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\DATACARDSERVICE\HWDEVICESERVICE.EXE delref %Sys32%\DRIVERS\I2OMGMT.SYS delref %Sys32%\DRIVERS\LBRTFDC.SYS delref %Sys32%\DRIVERS\MASSFILTER.SYS delref %SystemDrive%\PROGRAM FILES\AUTODESK\3DS MAX 9\MENTALRAY\SATELLITE\RAYSAT_3DSMAX9_32SERVER.EXE delref %Sys32%\DRIVERS\MONFILT.SYS delref I:\CDRIVER.SYS delref %Sys32%\DRIVERS\PCASP50.SYS delref %Sys32%\DRIVERS\PCIDUMP.SYS delref %Sys32%\DRIVERS\PDCOMP.SYS delref %Sys32%\DRIVERS\PDFRAME.SYS delref %Sys32%\DRIVERS\PDRELI.SYS delref %Sys32%\DRIVERS\PDRFRAME.SYS delref %SystemDrive%\PROGRAM FILES\WINPCAP\RPCAPD.INI delref %Sys32%\DRIVERS\TOTREC8.SYS delref %Sys32%\DRIVERS\WDICA.SYS delref %Sys32%\DRIVERS\ZTEUSBMDM6K.SYS delref %Sys32%\DRIVERS\ZTEUSBNMEA.SYS delref %Sys32%\DRIVERS\ZTEUSBSER6K.SYS delref %Sys32%\PSXSS.EXE delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\[email protected] delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\[email protected] delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{1018E4D6-728F-4B20-AD56-37578A4DE76B} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{1BC9BA34-1EED-42CA-A505-6D2F1A935BBB} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{54BB9F3F-07E5-486C-9B39-C7398B99391C} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{582195F5-92E7-40A0-A127-DB71295901D7} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{A0D7CCB3-214D-498B-B4AA-0E8FDA9A7BF7} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{CD617375-6743-4EE8-BAC4-FBF10F35729E} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{DC572301-7619-498C-A57D-39143191B318} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781} delref %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\BROWSER\EXTENSIONS\{972CE4C6-7E08-4474-A285-3208198CE6FD} delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.115\PSUSER.DLL delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.123\PSUSER.DLL delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.111\PSUSER.DLL delref %SystemDrive%\PROGRA~1\AIMP2\AIMP2.EXE delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.22.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.33.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.25.11\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.23.9\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.35.453\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.7\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.25.5\PSMACHINE.DLL delref %SystemDrive%\PROGRAM FILES\GOOGLE\UPDATE\1.3.24.15\PSMACHINE.DLL delref E:\AUTORUN.EXE delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\UPDATE\1.3.21.123\NPGOOGLEUPDATE3.DLL delref {09900DE8-1DCA-443F-9243-26FF581438AF}\[CLSID] delref {3049C3E9-B461-4BC5-8870-4C09146192CA}\[CLSID] delref {32099AAC-C132-4136-9E9A-4E364A424E17}\[CLSID] delref {4FE56B69-437F-45A9-9CAD-E1D1ED34DBE3}\[CLSID] delref {8984B388-A5BB-4DF7-B274-77B879E179DB}\[CLSID] delref {8DCB7100-DF86-4384-8842-8FA844297B3F}\[CLSID] delref {91397D20-1446-11D4-8AF4-0040CA1127B6}\[CLSID] delref {C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\[CLSID] delref {C442AC41-9200-4770-8CC0-7CDB4F245C55}\[CLSID] delref {C93F72A2-2162-4BBA-A07A-F13663C297A6}\[CLSID] delref {D2CE3E00-F94A-4740-988E-03DC2F38C34F}\[CLSID] delref {DFEAF541-F3E1-4C24-ACAC-99C30715084A}\[CLSID] delref {E7E6F031-17CE-4C07-BC86-EABFE594F69C}\[CLSID] delref {EEE6C35B-6118-11DC-9C72-001320C79847}\[CLSID] delref {EEE6C35C-6118-11DC-9C72-001320C79847}\[CLSID] delref {EEE6C35D-6118-11DC-9C72-001320C79847}\[CLSID] delref {A5239E24-2BCF-4915-9C5C-FD50C0F69DB2}\[CLSID] delall %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\SEARCHPLUGINS\WEBALTA SEARCH-20185803.XML delall %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\0DHLTXI5.DEFAULT\SEARCHPLUGINS\YANDEX-20185803.XML delall %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\K7WUI19F.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}\INSTALL.RDF delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\APPLICATION DATA\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\EXTENSIONS\MFLDBNIFMJGEBMHEPMMODNCEFCKDOKBH\3.1.17.76_0\СОВЕТНИК ЯНДЕКС.МАРКЕТА apply |
+
Далее (даже если проблема решена) выполните лог в: AdwCleaner
2) Выполните лог в AdwCleaner
после завершения сканирования:
Записи относящиеся к Mail.Ru и Yandex можете не удалять ( если пользуетесь программой )
На вкладке:
Папки (Folders) для Mail.Ru и Yandex снимите [V]
Удалите найденное в AdwCleaner по кнопке Очистить (Clean), подтвердите действие
с автоперезагрузкой