;uVS v3.87.2 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
OFFSGNSAVE
delall %SystemDrive%\TEMP\2.EXE
delall %SystemDrive%\TEMP\AMISETUP7247__10235_IL1.EXE
delall %Sys32%\DRIVERS\TSSKX64.SYS
delall %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\TENCENT\QQDOWNLOAD\130\TENCENTDL.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\QQREPAIRFIXSVC
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\QQREPAIRDC4
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\QQREPAIRD09
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\QQREPAIR7D1
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\11.5.17490.219\PLUGINS\FILESMASH\QMSOFTEXT.DLL
delall %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\11.5.17490.219\TSNETHLPX64.SYS
delref HTTP://FIRSTSPUTNIK.RU/?RI=1&UID=08791C416D5E47448BA877FCC714387D&Q={SEARCHTERMS}
delall %SystemDrive%\PROGRAM FILES (X86)\TORRENT SEARCH\IEEF\6HUFV2TS2BTT.EXE
delall %SystemDrive%\USERS\SVI9TOI\APPDATA\ROAMING\GPLYRA\GPLYRA\START.CMD
delall %SystemDrive%\USERS\SVI9TOI\REPORTSENDER\REPORTSENDER.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\SHEFALE\SHEFALECLOUDTASK.EXE
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\CFHDOJBKJHNKLBPKDAIBDCCDDILIFDDB\1.11_0\ADBLOCK PLUS
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\CFHDOJBKJHNKLBPKDAIBDCCDDILIFDDB\1.11_0\ADBLOCK PLUS
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\LJIKCIHKPKLKBFHNFLMBCEPICOHFELDC\2.0_0\APIDOG PLUS
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\CAJEJBCJFKHGMFBAPMHOPCCEPHHJEDEB\2.2.1_0\JUNKFILL
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\SYSTEM PROFILE\EXTENSIONS\ACOIIHNNFOFNPBNOFDCGCAPBJLCOPIFA\1.3.8\QUICK SEARCHER
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\ACOIIHNNFOFNPBNOFDCGCAPBJLCOPIFA\1.4.1_0\SHINE FOR REDDIT
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\SYSTEM PROFILE\EXTENSIONS\BLPCFGOKAKMGNKCOJHHKBFBLDKACNBEO\4.2.7_0\YOUTUBE
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\PROFILE 1\EXTENSIONS\BLPCFGOKAKMGNKCOJHHKBFBLDKACNBEO\4.2.8_0\YOUTUBE
delref %SystemDrive%\USERS\SVI9TOI\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\CHROMEDEFAULTDATA\EXTENSIONS\GOALOJOOBCFKHDDPBJCMHDCEEEGMAPHH\2.1.8.0_0\СОВЕТНИК ТЕСЛЫ
delall %SystemDrive%\PROGRAM FILES (X86)\TORRENT SEARCH\IEEF\MYH7XTKJDCN7.DLL
regt 14
deltmp
delnfr
restart

IFEO\adwcleaner_5.005.exe: [Debugger] svchost.exe
IFEO\mbam.exe: [Debugger] svchost.exe
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Tcpip\..\Interfaces\{1E8B74D2-FEAE-43EC-8BD3-6B5450721DB6}: [DhcpNameServer] 7.254.254.254
HKU\S-1-5-21-3876235246-275499464-372269726-1000\Software\Microsoft\Internet Explorer\Main,Start Pa = hxxp://search.trident.com.ua/?page=yandex&client=ie&rls=org.mozilla:us:official
FF NewTab: hxxp://d2ucfwpxlh3zh3.cloudfront.net/?ts=AHEqAnQrBnMsA0..&v=20160518&uid=AD00E3EFF7A69C9BDD1D5997BE2C67D8&ptid=amz&mode=loadm
FF Homepage: hxxp://d2ucfwpxlh3zh3.cloudfront.net/?ts=AHEqAnQrBnMsA0..&v=20160518&uid=AD00E3EFF7A69C9BDD1D5997BE2C67D8&ptid=amz&mode=loadm
FF SearchPlugin: C:\Users\SvI9ToI\AppData\Roaming\Profiles\43k5ir9l.default\searchplugins\z3qlz3lo.xml [2016-05-20]
FF Extension: GsearchFinder - C:\Users\SvI9ToI\AppData\Roaming\Profiles\43k5ir9l.default\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-05-19]
CHR StartupUrls: Profile 1 -> "hxxp://isearch.omiga-plus.com/?type=hp&ts=1418106237&from=smt&uid=ST1000LM024XHN-M101MBB_S2U5J9CCC50238","hxxp://search.yahoo.com/?fr=hp-ddc-bd&type=804_pr__alt__ddc_dsssyc_bd_com","hxxp://search.yahoo.com/?fr=hp-ddc-bd&type=348_pr__alt__ddc_dsssyc_bd_com","hxxp://rts.dsrlte.com/?affID=pr_1f970184-ed18-41b8-b675-eb42f51f8a3e","hxxp://mail.ru/cnt/10445?gp=blackbear2","hxxp://mail.ru/cnt/10445?gp=blackbear3","hxxp://mail.ru/cnt/10445?gp=811009"
CHR Extension: (JunkFill) - C:\Users\SvI9ToI\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cajejbcjfkhgmfbapmhopccephhjedeb [2016-05-30]
CHR Extension: (Adblock Plus) - C:\Users\SvI9ToI\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-05-30]
CHR HKLM-x32\...\Chrome\Extension: [bgcifljfapbhgiehkjlckfjmgeojijcb] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eioddfaepdoeifbhjphfefgipcjcdieo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iflppbjnpneiigcbdfjpnkebidmkjmoi] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lbjjfiihgfegniolckphpnfaokdkbmdm] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
U3 aegf1q43; C:\Windows\System32\Drivers\aegf1q43.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
R3 gkernel; \??\C:\Temp\gkernel.sys [X]
Task: {41D9422B-453F-4F7B-BDCE-B71182695278} - \Driver Booster SkipUAC (SvI9ToI) -> No File <==== ATTENTION
Task: {879E9936-26FD-41D0-B590-5D6CA6F6CEE5} - \{5F7F6183-9569-4F61-B9F4-8463BB9E933E} -> No File <==== ATTENTION
Task: {B9A237C4-8B5F-4A76-8858-8E877BCAAE11} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {CC2DA9CD-6009-4566-980F-961173AB94EB} - \{68F9AA75-7438-447F-B0F4-8499E3EEA458} -> No File <==== ATTENTION
EmptyTemp:
Reboot: