выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v3.87.9 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
zoo %SystemDrive%\PROGRAM FILES (X86)\READALEANERNERT CLIENT\LOCAL64SPL.DLL
addsgn BA652BBE5D22C5062FC4F9F9E724324CAE72772CC171EEFB7FC2B0B9B8ED584C235B4890B586D5C2E5C80FC36226017109FBD03AD61E9073C474A42FC7CAEEBF 64 Win64/Adware.ELEX
zoo %SystemDrive%\PROGRAM FILES\UBAR\UBARSERVICE.EXE
addsgn BA6F9BB2BDD958720B9C2D754C2150FBDA75303AC9A957FB69E38D37892964959517C3EE3F559D49A28582DE4716A1F765DFE83ADE1158293377A4ACFAF46272 8 Adware.Plugin.1444 [DrWeb]
zoo %SystemDrive%\PROGRAM FILES\UBAR\UBAR.EXE
addsgn BA6F9BB2BDF541730B9C2D754C2150FBDA75303AC9AF5E2CC4958D3DBC96754C235F48526A10B94963B340D7CF926DFA79DFE83FDE2BF9A7C53B2FCE8F83EB06 8 Adware.Plugin.1444 [DrWeb]
zoo %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\FUPDATE\FUPDATE.EXE
addsgn 1A26739A5583CC8CF42B5194B849530570011000CCF21E2E0E3202BA3C51304C571DA95B68BDA3B5D47FDDC6CDD017A7BFDBE8BE99167C7DA03B8027ECCEA192 8 Win32/Adware.RuKoma
zoo %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\SEARCHGO\SEARCHGO.EXE
addsgn 1AE2B39A5583338CF42B464E1BC8128EF501BE9AB2FF2B67C0C3B1ACDBDB89536617461D4E2098A1B7F6849FCD564D3995069772555160A76F1B9F2AF3196773 8 Win32/Adware.SearchGo
zoo %SystemDrive%\USERS\ADMIN\APPDATA\LOCALLOW\SEARCHGO\SEARCHGO.DLL
addsgn A7679B1928664D070E3C821F64C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D1DBA28906C5F0F1649C9BD9F6307595F4659214E91378402327C 64 Win32/Adware.SearchGo
addsgn A7679B1928664D070E3C99479B37ED70357589FA768F17906BAEC5BCD3127D11E11BC30169EB65A02A903B67AF1759117654EEF795AEB2D3FDF4622BFCF15082 64 Win32/Adware.ELEX
zoo %SystemDrive%\PROGRAM FILES (X86)\SILULEPHEDAGH\PLMCACHE.DLL
addsgn A7679B1928664D070E3CFEA765C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323D1D902D906CEC1A1649C9BD9F6307595F4659214E91CFFB01327C 64 Win32/Adware.ELEX
zoo %SystemDrive%\PROGRAMDATA\WINSAPSVC\WINSAP.DLL
addsgn A7679BF0AA021C0E42D4C6A95C881261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C8B10C49F75C4C32EF4CAECB81FDA3BE4AC965B2FC706AB7E 8 Win32/Kryptik
zoo %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\COMDEV\COMDEV.EXE
delref %SystemDrive%\USERS\ADMIN\APPDATA\ROAMING\PBOT\PYTHON\PYTHONW.EXE
addsgn A7679B1928664D070E3C00A29B37ED70357589FA768F17904272C7BCD3127D11E11BC301B5A4160F3B0544E14CE93FF6957D568CAA31BA552488D2232F8A808D 64 Win32/Adware.ELEX
zoo %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\SERVICES\ITHEMES.DLL
addsgn BA652BBE5D22C5062FC4F9F9E724324CAE72772CC171EEFB7FC2B0B9B8FD0DB3DC5B4890B586D5C2E5C80FC36226017109FBD03AD61E9073C474A42FC7CAEEBF 64 Win64/Adware.ELEX
zoo %SystemDrive%\USERS\ADMIN\APPDATA\ROAMING\PTIINGVETERTAIN\DRASERANEAY.DLL
delref APP.PY
;------------------------autoscript---------------------------
chklst
delvir
delref %SystemDrive%\PROGRAM FILES (X86)\WINARCHER\ARCHER.DLL
del %SystemDrive%\PROGRAM FILES (X86)\WINARCHER\ARCHER.DLL
delref %SystemDrive%\USERS\ADMIN\APPDATA\ROAMING\PHOENIX.ENGINE.V01.212711\OF.6.EXE
del %SystemDrive%\USERS\ADMIN\APPDATA\ROAMING\PHOENIX.ENGINE.V01.212711\OF.6.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MIO\MIO.EXE
del %SystemDrive%\PROGRAM FILES (X86)\MIO\MIO.EXE
delref ST1000LM024XHN-M101MBB_S32XJ9GF908603.EXE
deldirex %SystemDrive%\USERS\ADMIN\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBHJCGOMKANPKPBLOKEBECKNHAHGKCMOO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCCFIFBOJENKENPKMNBNNDEADPFDIFFOF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFDJDJKKJOIOMAFNIHNOBKINNFJNNLHDG%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DICANJJKADCEEBMHANPEKKOFDHCLNOIJL%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLGDNILODCPLJOMELBBNPGDOGDBMCLBNI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.25_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\CPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK\2.0.4.11_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\OJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD\12.0.11_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\7.0.25_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\CPEGCOPCFAJIIIBIDLAELHJJBLPEFBJK\2.0.4.11_0\СТАРТОВАЯ — ЯНДЕКС
delref %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\OJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD\12.0.11_0\ПОИСК MAIL.RU
delref HTTP://GRANENA.RU/?UTM_SOURCE=UOUA03N&UTM_CONTENT=E739009BCCD5F1E6D71A91BFF5994529&UTM_TERM=74F515E55772D5260256C05CEE5B1EDA&UTM_D=20161120
deldirex %SystemDrive%\PROGRAM FILES (X86)\ZAXAR
deldirex %SystemDrive%\USERS\ADMIN\APPDATA\LOCAL\UNITY\WEBPLAYER
; AnySend
exec C:\Program Files (x86)\418a3f60-7d82-4369-960a-79733d3250011484674669\Uninstall.exe
; OpenAL
exec C:\Program Files (x86)\OpenAL\OpenAL.exe" /U
; Zaxar Games Browser 4
exec C:\Program Files (x86)\Zaxar\unins000.exe
deltmp
delnfr
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните сканирование (угроз) в Malwarebytes