выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v3.87.7 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES\WEDSOFT\QV7DLG.EXE
addsgn 1AC5299A5583338CF42B627DA804DEC9E946303A4536D3B4494891985C5D3D6827921123415A2B0D0F888B25639E7BB87DDE9B7FDE9694207AFCD80BCFF58898 8 Trojan.StartPage1.24172 [DrWeb]
zoo %SystemDrive%\PROGRAM FILES\SKILLBRAINS\UPDATER\UPDATER.EXE
addsgn 1AF7349A5583338CF42BFB3A88999F40D9DA948A8BBB1F12853CD038509771C9E363D43FAA57DC49D4F57860539E49BB7D5A28065025C524D2A72FCA9AC577F8 8 Adware.Wombat.8 [DrWeb]
zoo %SystemDrive%\PROGRAMDATA\SERFEV\TRANSING.DLL
addsgn A7679B1928664D070E3C125B64C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D1DCC28906CE3531649C9BD9F6307595F4659214E91E31205327C 64 Win32/Toolbar.Linkury
zoo %SystemDrive%\PROGRAMDATA\AFOIR\GEOEX.DLL
zoo %SystemDrive%\USERS\444\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE
addsgn 9252771A116AC1CC0B44554E33231995AF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 14 Win32:FakeSys-BF [PUP]
addsgn A7679B1928664D070E3C3C5564C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D8D2C28906C264F1649C9BD9F6307595F4659214E916B7205327C 64 Win32/Toolbar.Linkury
zoo %SystemDrive%\PROGRAMDATA\XIFS\OPENPHASE.DLL
delref %SystemDrive%\PROGRAMDATA\SULPNAR\DING-STRING.REG
delref %SystemDrive%\PROGRAMDATA\SULPNAR\ITLUX.REG
delref %SystemDrive%\PROGRAMDATA\CAMYCILOP\KAYLEX.REG
delref %SystemDrive%\PROGRAMDATA\SERFEV\LAMWARM.REG
delref %SystemDrive%\PROGRAMDATA\SULPNAR\RANJOB.REG
delref %SystemDrive%\PROGRAMDATA\XIFS\SIL-FIX.REG
delref %SystemDrive%\PROGRAMDATA\SERFEV\SING-FAX.REG
delref %SystemDrive%\PROGRAMDATA\AFOIR\TRESTAM.REG
delref %SystemDrive%\PROGRAMDATA\AFOIR\TRIOTIP.REG
delref %SystemDrive%\PROGRAMDATA\SERFEV\TRISFIX.REG
delref %SystemDrive%\PROGRAMDATA\XIFS\TRUEREMFLEX.REG
delref %SystemDrive%\PROGRAMDATA\SULPNAR\VOLTPHASE.REG
delref %SystemDrive%\PROGRAMDATA\SERFEV\XXX-TOM.REG
delref %Sys32%\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\ZOOM
;------------------------autoscript---------------------------
chklst
delvir
delref %SystemDrive%\PROGRAM FILES\MYPC BACKUP\MYPC BACKUP.EXE
delref %SystemDrive%\PROGRAM FILES\PC PERFORMER\PCPERFORMER.EXE
deldirex %SystemDrive%\USERS\444\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAEEMBEEJEKGHKOPIABADONPMFPIGOJOK%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBEJNPNKHFGFKCPGIKIINOJLMDCJIMOBI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFCGNIGMOFEKCLLGBIEJHMIGGGMGEHKIP%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGDLJKKMGHDKCKHAOGAEMGBGDFOPHKFCO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGLCIMEPNLJOHOLDMJCHKLOAFKGGFOIJH%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLBJJFIIHGFEGNIOLCKPHPNFAOKDKBMDM%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC
deldirex %SystemDrive%\PROGRAM FILES\ASKPARTNERNETWORK\TOOLBAR
delref %SystemDrive%\USERS\444\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZXL0NRJC.DEFAULT\EXTENSIONS\TOOLBAR_SOCIALTB@APN.ASK.COM.XPI
delref %SystemDrive%\USERS\444\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.25_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\444\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\CPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK\2.0.4.11_1\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\444\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HPCGHCDJNEHPKDECAFLPEDHKLIMNEJIA\2.0.0.11_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\444\APPDATA\LOCAL\YANDEX\UPDATER\PRAETORIAN.EXE
deldirex %SystemDrive%\USERS\444\APPDATA\LOCAL\MEDIAGET2
regt 28
regt 29
delhst 13.69.186.195 disk.yandex.com
delhst 13.69.186.195 google.egypt.googlesearch.africa.com
delhst 13.69.186.195 google.search.uk.com
delhst 13.69.186.195 news-clck.yandex.by
delhst 13.69.186.195 news-clck.yandex.ua
delhst 13.69.186.195 www.google.egypt.googlesearch.africa.com
delhst 13.69.186.195 www.yandex.com.tr
delhst 13.69.186.195 ya.03compu.ru
delhst 13.69.186.195 yandex.by
delhst 13.69.186.195 yandex.com
delhst 13.69.186.195 yandex.com.tr
delhst 13.69.186.195 yandex.kz
delhst 13.69.186.195 yandex.ua
REGT 14
deltmp
delnfr
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните быстрое сканирование (угроз) в Malwarebytes