;uVS v4.0.6 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

delref MICROSOFT\MSI.EXE
delref %Sys32%\WINSS.EXE
zoo %SystemDrive%\PROGRAM FILES (X86)\SKILLBRAINS\UPDATER\UPDATER.EXE
addsgn 1AF7349A5583338CF42BFB3A88999F40D9DA948A8BBB1F12853CD038509771C9E363D43FAA57DC49D4F57860539E49BB7D5A28065025C524D2A72FCA9AC577F8 8 Adware.Wombat.8 [DrWeb] 7

zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\MICROSOFT\MSI.EXE
addsgn A7679BF0AA020C7A49D4C62D47881261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C4BC0C49F75C4C32EF4CAC42B0DDA3BE4AC965B2FC706AB7E 8 Win32/GenKryptik 7

zoo %SystemRoot%\FONTS\SPPSRV.EXE
addsgn 19E49071506A4C720BD447C6CB37ED05258AFCF689FA1F7885C3C5BC50D6714C2317C3573E559D492B80849F461649FA7DDFE87255DAB02C2D77A42FC7062273 8 Win32/CoinMiner 7

zoo %SystemRoot%\SYSWOW64\THEMCTRL.DLL
addsgn 79132211B9E9317E0AA1AB59C9A01205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5C37EAA9F469D04F2F497FC2F963241022D772FE74C47361A 64 TrojanDownloader.Stantinko 7

zoo %SystemRoot%\SYSWOW64\WBIOSRVP.DLL
addsgn 79132211B9E9317E0AA1AB59B4B21205DAFFF47DC4EA942D892B2942AF292811E11BC3DCC10016A5AA6CAC9C4616EA3A6EDAF8FB5866A3293DFEB197D40332FA 64 TrojanDownloader.Stantinko 7

zoo %SystemRoot%TMP01.EXE
addsgn 19E42027506A4C720BD44739A337ED05258AFCF689FA1F7885C3C5BC50D6714C2317C3573E559D492B80849F461649FA7DDFE87255DAB02C2D77A42FC7062273 8 Trojan:Win32/Adylkuzz 7

zoo %SystemRoot%\MSSECSVC.EXE
addsgn A7679BF0AA02ECD34BD4C613FF881261848AFCF689AA7BF1A0C3C5BC50559D24704194DE5BBDAE92A2DD78F544E95C3ADD9FE82BD6D724D45D775BACCA9EDA03 8 Win32/Exploit.CVE-2017-0147 7

chklst
delvir

deldirex %SystemDrive%\USERS\USER\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

deldirex %SystemDrive%\PROGRAMDATA\TENCENT\TSVULFW

deldirex %SystemDrive%\PROGRAMDATA\TENCENT\QQPCMGR\QUARANTINE

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPNOOFFJHCLKOCPLOPFFDBCDGHMIFFHJI%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DEFAIDNBMNNNIBPCAJPCGLCLEFINDMKAJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP:\\AXSEARCH.RU
apply

deltmp
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\CHROME_BITS_2464_30026\19.108.1_WIN64_SOFTWAREREPORTER.CRX2
delref %SystemDrive%\PROGRAM FILES (X86)\ASUS\GPU TWEAK\ASUSLIVEUPDATE.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\NERO\NERO INFO\NEROINFO.EXE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\FILTERSTART\FILTERSTART.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\REG ORGANIZER\REGORGANIZER.EXE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\MAIL.RU\GAMECENTER\GAMECENTER@MAIL.RU.EXE
delref %SystemRoot%\SYSWOW64\TBSSVC.DLL
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\UMPO.DLL
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.EXE
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\2.7.1\BATTLELOGAX.OCX
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {9EBCBE55-8F2E-46FF-8585-836DA82A2623}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\2.7.1\NPBATTLELOG.DLL
delref {F764812A-132C-4013-9960-5CBBEB408A0E}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\BANDIMPEG1\BDFILTERS64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\BANDIMPEG1\BDFILTERS.DLL
delref {171252A0-8820-4AFE-9DF8-5C92B2D66B04}\[CLSID]
delref {B98D13E7-55DB-4385-A33D-09FD1BA26338}\[CLSID]
delref {E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\[CLSID]
delref {EE30215D-164F-4A92-A4EB-9D4C13390F9F}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\BATTLELOG WEB PLUGINS\2.7.1\NPBATTLELOGX64.DLL
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\REG ORGANIZER\STARTUPCHECKINGSERVICE.EXE
delref %Sys32%\DRIVERS\SYNTH3DVSC.SYS
delref %Sys32%\DRIVERS\TSUSBHUB.SYS
delref %Sys32%\DRIVERS\RDVGKMD.SYS
delref %Sys32%\DRIVERS\XHUNTER1.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\NERO\NERO 2014\NERO BURNING ROM\NFD\NEROFILEDIALOGIDLPS.DLL
delref F:\LENOVOUSBDRIVER.EXE
delref {219C3416-8CB2-491A-A3C7-D9FCDDC9D600}\[CLSID]
delref {2670000A-7350-4F3C-8081-5663EE0C6C49}\[CLSID]
delref {40AEF60B-A6F8-4389-9003-A683DD75B850}\[CLSID]
delref {5A8FF410-F3CE-4844-B31B-F18D911239E8}\[CLSID]
delref {76D50904-6780-4C8B-8986-1A7EE0B1716D}\[CLSID]
delref {7AEFE841-DCA1-4A95-80CB-BE935D020602}\[CLSID]
delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID]
delref %SystemDrive%\USERS\USER\APPDATA\ROAMING\UTORRENT\UTORRENT.EXE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\UMMYVIDEODOWNLOADER\UMMYVIDEODOWNLOADER.EXE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\UMMYVIDEODOWNLOADER\UNINS000.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\BANDICAM\BDCAM.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\AIDA64\AIDA64.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\AIDA64\UNINS000.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\BANDICAM\BDFIX.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\BANDICAM\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\PDF READER\SUMATRAPDF.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\PDF READER\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\REG ORGANIZER\УДАЛИТЬ REG ORGANIZER.EXE
;-------------------------------------------------------------

restart