выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v3.87.8 [http://dsrt.dyndns.org]
;Target OS: NTv10.0
OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES (X86)\ZAXAR\ZAXARGAMEBROWSER.EXE
addsgn 1A69739A55832F8FF42B254E3143FE84C9A2FFF6895927BFCAC34CB164113E4CAA02F390715514540747CB9FCF23613D32DF614F711DFF2C4BFBB17F00492215 11 Win32/ZaxarGames.B [ESET-NOD32]
zoo %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE
addsgn 9252771A116AC1CC0B44554E33231995AF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 14 Win32:FakeSys-BF [PUP]
hide %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\UNINSTALER_SKIPUAC.EXE
;------------------------autoscript---------------------------
chklst
delvir
deldirex %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\MEDIAGET2
deldirex %SystemDrive%\PROGRAM FILES (X86)\ZAXAR
delref %SystemDrive%\USERS\B30C~1\APPDATA\ROAMING\DIGITA~1\UPDATE~1\UPDATE~1.EXE
deldirex %SystemDrive%\USERS\B30C~1\APPDATA\ROAMING\DSITE\UPDATE~1
delref {8984B388-A5BB-4DF7-B274-77B879E179DB}\[CLSID]
delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID]
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAMINLPMKFCDIBGPGFAJLGNAMICJCKKJF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEFPDLFPBBALMEEGEICFPCANIEMLOOHCH%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DMAFPBCLKDIEJMPJNMIOIHCAFDNLBMKCO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DNKOOAPPJEONIFFJMOPLBAGPNGEDKCKPL%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.25_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\ECIJENGMOJCNGJJGGHKFKGBJOOGMLNGB\3.0.0.0_0\CINEMALOAD
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\FMFNFNPMHCLLOKMKEPFFNDFLPNADJMMA\3.9.4.9_0\DEALPLY BRAZIL
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\JDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI\1.0.3_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\OJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD\12.0.11_1\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PHKDCINMMLJBLPNKOHLIPAIODLONPINF\11.0.3_0\ПОИСК MAIL.RU
deldirex %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DODIJCGAFKHPOBJLNFDGIACPDENPMBGME%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPHKDCINMMLJBLPNKOHLIPAIODLONPINF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPMPOAAHLECCAIBBHFJFIMIGEPMFMMBBK%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\ROAMING\VKONTAKTEDJ\VKONTAKTEDJ.EXE
delref HTTP://YAMDEX.NET/?SEARCHID=1&L10N=RU&FROMSEARCH=1&IMSID=10C7EF8B9FDBAC80E670FB33148A4783&TEXT={SEARCHTERMS}
deldirex %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\MEDIA GET LLC\MEDIAGET2\USER_SEARCH\TSERVERINFO
deldirex %SystemDrive%\USERS\ГАЛЕРЕЯ\APPDATA\LOCAL\MEDIA GET LLC\MEDIAGET2\USER_SEARCH\SSERVERINFO
deltmp
delnfr
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните сканирование (угроз) в Malwarebytes