выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v3.87.8 [http://dsrt.dyndns.org]
;Target OS: NTv5.1
OFFSGNSAVE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\FUPDATE\FUPDATE.EXE
addsgn 1A26739A5583CC8CF42B5194B849530570011000CCF21E2E0E3202BA3C51304C571DA95B68BDA3B5D47FDDC6CDD017A7BFDBE8BE99167C7DA03B8027ECCEA192 8 Win32/Adware.RuKoma
zoo %SystemDrive%\PROGRAM FILES\YOUTUBE ADBLOCK\FJVQJUF.EXE
addsgn 1A16359A5583338CF42B627DA8049949018E0B378AFA1F78F1E74FBDD31770C8E3638DA0FF569D492BF56B9A461649FAF07BCC7255DAB0A18953A42FC706A972 8 Yutube_adblock
zoo %SystemDrive%\PROGRAM FILES\MEGAFON MODEM\AUTORUN\AUTORUNSETUP.EXE
addsgn 7300F79B556A1F275DE775E6ED94361DE2CED8E6E96B5F78B63503F874C251B33627B3173E3D9CC92B807B8AF66609FA2E20FD0E279AB04625D49C108506CA82 59 Win32/ExtenBro.BW [ESET-NOD32]
addsgn A7679BF0AA028CD242D4C6AD4F881261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C4790C59F75C4C32EF4CA40FD1FDA3BE4AC965B2FC706AB7E 8 Win32/Kryptik
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\SYSLOG\SYSLOG.EXE
hide %SystemDrive%\PROGRAM FILES\FASTSTONE IMAGE VIEWER\UNINST.EXE
hide %SystemDrive%\PROGRAM FILES\MEGAFON MODEM\AUTORUN\AUTORUNSETUP.EXE
addsgn A7679BF0AA02BC8F4BD4C6C942881261848AFCF689AA7BF1A0C3C5BC5055B5E8704194DE5BBD625C1320C49FE516DAB67D7EE8E119DA71C425525B2FC706817F 8 tr
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\\5T2J58GVNMJP.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\F2GLCOHH2JKZ.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\\F2GLCOHH2JKZ.EXE
zoo E:\SOFT\FIX.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\PMIOVVZECRKB.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\\PMIOVVZECRKB.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\M9M3H5BLXVGN.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\\M9M3H5BLXVGN.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\UBWRCKYH4SDN.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\\UBWRCKYH4SDN.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\TEMP\5T2J58GVNMJP.EXE
;------------------------autoscript---------------------------
chklst
delvir
delref HTTP://IMATIRO.RU/?UTM_SOURCE=FAVORITES03&UTM_CONTENT=68EBACCD633AE9C8B5AA86B782B375B8&UTM_TERM=$__MID&UTM_D=$__UTMD|ИНТЕРНЕТ
delref HTTP://CMPNYESXTZUJM.SHAKETODAY.RU/SOFTWARE_INSTALL?HETAG=4982A955A8C43635153ED433C21A631E&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=123783428&DID=2610814680&EXT_PARTNER_ID=&2INF_FAVORITES=1&EXT_PARTNER_ID=
delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\FILTERSTART\FILTERSTART.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\FILTERSTART\FILTERSTART.EXE
delref HTTP://CKTFTNCBLBFP.SHAKETODAY.RU/SOFTWARE_INSTALL?HETAG=CA110C1ACBDDD0E05C3C998B3F13A8E3&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=123783428&DID=2610814680&EXT_PARTNER_ID=&2INF_FAVORITES=1&EXT_PARTNER_ID=
delref %SystemDrive%\PROGRAM FILES\SCREENUP\FUTURE_HELPER.EXE
del %SystemDrive%\PROGRAM FILES\SCREENUP\FUTURE_HELPER.EXE
delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\APPLICATION DATA\PBOT\PYTHON\PYTHONW.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\APPLICATION DATA\PBOT\PYTHON\PYTHONW.EXE
delref HTTP://IMATIRO.RU/?UTM_SOURCE=PINNEDTABS03&UTM_CONTENT=D226542965C9975DB8F87CE506C5F815&UTM_TERM=$__MID&UTM_D=20161209
delref HTTP://CKTFTNCBLBFP.SHAKETODAY.RU/SOFTWARE_INSTALL?HETAG=CA110C1ACBDDD0E05C3C998B3F13A8E3&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=123783428&DID=2610814680&EXT_PARTNER_ID=&2INF_PINNEDTABS=1&EXT_PARTNER_ID=
delref HTTP://IMATIRO.RU/?UTM_SOURCE=SPEEDDIAL03&UTM_CONTENT=105520340FB58B7EFC18FF3244E31F45&UTM_TERM=$__MID&UTM_D=$__UTMD
delref HTTP://UPHEMIA.SLAP-LAWN-PART.RU/2INF_SPEADDIAL.PNG
delref HTTP://CKTFTNCBLBFP.SHAKETODAY.RU/SOFTWARE_INSTALL?HETAG=CA110C1ACBDDD0E05C3C998B3F13A8E3&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=123783428&DID=2610814680&EXT_PARTNER_ID=&2INF_SPEEDDIAL=1&EXT_PARTNER_ID=
delref HTTP://IMATIRO.RU/?UTM_SOURCE=STARTPAGE03&UTM_CONTENT=56015C7093D8730E649B4C36B97176FA&UTM_TERM=$__MID&UTM_D=$__UTMD
delref HTTP://CKTFTNCBLBFP.SHAKETODAY.RU/SOFTWARE_INSTALL?HETAG=CA110C1ACBDDD0E05C3C998B3F13A8E3&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=123783428&DID=2610814680&EXT_PARTNER_ID=&EXT_PARTNER_ID=&2INF_STARTPAGE=1
delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\SEARCHGO\SEARCHGO.EXE
del %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\SEARCHGO\SEARCHGO.EXE
deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\UNITY\WEBPLAYER\LOADER
delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\LINE RENDER HELPER.EXE S
del %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\LINE RENDER HELPER.EXE S
delref HTTP://IMATIRO.RU/?UTM_SOURCE=UOUA03&UTM_CONTENT=2AB9A970874B6C3A100DDBE365669EC3&UTM_TERM=35BE9199D259E171BBA590887C7FCF68&UTM_D=20161209
deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\KOMETA\PANEL
deldirex %SystemDrive%\DOCUMENTS AND SETTINGS\ALEX\LOCAL SETTINGS\APPLICATION DATA\KOMETA\PANEL\1.0.0.775
regt 27
deltmp
delnfr
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните быстрое сканирование (угроз) в Malwarebytes