;uVS v4.0.6 [http://dsrt.dyndns.org]
;Target OS: NTv6.3
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

zoo %Sys32%\ICACL.EXE
addsgn BA6F9BB2BD8D7F730B9C2D754C211005258A303AC173435C958B4CC874CE2604A0FBF3BF12049D4924377426441649FA95D05F725562FD762D77ECA2FAADBC88 8 Trojan.LoadMoney 7

zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\B571.TMP
addsgn A7679BF0AA025C964BD4C6F552881261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C9310C49F75C4C32EF4CAACF31EDA3BE4AC965B2FC706AB7E 8 Win32/Kryptik 7

zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\E84C.TMP.EXE
zoo %SystemDrive%\PROGRAM FILES\56F1A840253859D5F69024AF5B67045D\33659B9FBF3D8D418F9AACA588E23B98.EXE
addsgn 1A4A739A5583C28CF42BFB3A889EED702D010D1E7909E08742C5A9AA18D6FA8A7D4A01533ED6FC4D2B0B451C271E493D3CDB9C641DDA772D4161EC2F0453A99F 8 BrowserModifier:Win32/Soctusee 7

zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\SEARCHGO\SEARCHGO.EXE
addsgn 1A74B39A5583338CF42B627DA804DEC9E946303A4536D3B44994933724F261C76F33D7DC427191C2EA0B559C802DB78C75E4107DD7B2B32C2D781E0AC7866773 8 Adware.SearchGo 7

zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\WMIPR\WMIPR.EXE
zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\WUPDATE\WUPDATE.EXE
addsgn 1A69279A5583338CF42BFB3A884BFE2573DD96FED0449F0CC4C348C1B025D4C7561B482A36D06B3D3876828F3218C2F5FE36EC23DEDB3B5C3588F40F4E7BDAFA 8 Win32/Adware.RuKoma 7

zoo %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCALLOW\SEARCHGO\SEARCHGO.DLL
addsgn A7679B1928664D070E3C521F64C8ED70357589FA768F179082C3C5BCD3127D11E11BC33D323DADBB28906C2F0F1649C9BD9F6307595F4659214E91378502327C 64 Win32/Adware.SearchGo 7

chklst
delvir

delref %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\MICROSOFT\MSI.EXE
del %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\MICROSOFT\MSI.EXE
delref %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\5PYBE7CHUGVM.EXE
del %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\5PYBE7CHUGVM.EXE
delref HTTP://FURYERY.RU/?UTM_SOURCE=FAVORITES03&UTM_CONTENT=29451751159D15731C4D3FA7E779890D&UTM_TERM=$__MID&UTM_D=$__UTMD|ИНТЕРНЕТ
delref HTTP://DIOUGFZBVHNI.SHOCKTOUCH.RU/SOFTWARE_INSTALL?HETAG=BA8F23203C019F3E831F81C100D3FCAD&GUID=$__GUID&SIG=$__SIG&OVR=$__OVR&DEFAULT=$__DEFAULT&BR=$__BROWSER&FILE_ID=20911595&DID=2748379842&EXT_PARTNER_ID=&2INF_FAVORITES=1&EXT_PARTNER_ID=
delref %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\CURL\CURL_7_54.EXE
del %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\CURL\CURL_7_54.EXE
delref %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\CURL\CURL.EXE
del %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\CURL\CURL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\YUBEALCKIE\TS79PZDF.DLL
del %SystemDrive%\PROGRAM FILES (X86)\YUBEALCKIE\TS79PZDF.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\YUBEALCKIE\KVAFZWBV0.DLL
del %SystemDrive%\PROGRAM FILES (X86)\YUBEALCKIE\KVAFZWBV0.DLL
delref %SystemDrive%\PROGRAM FILES\WINDOWS MULTIMEDIA PLATFORM\DPYKJ7V10LJJQA8D3721RRLI\R&WNLK4ITS.EXE
del %SystemDrive%\PROGRAM FILES\WINDOWS MULTIMEDIA PLATFORM\DPYKJ7V10LJJQA8D3721RRLI\R&WNLK4ITS.EXE
delref %SystemDrive%\PROGRAM FILES\WINDOWS PORTABLE DEVICES\027NR3MUG082V4TYIGFN0TGS98I\HF3UE-3CMG.EXE
del %SystemDrive%\PROGRAM FILES\WINDOWS PORTABLE DEVICES\027NR3MUG082V4TYIGFN0TGS98I\HF3UE-3CMG.EXE
delref %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\853EFECEF8C64D1A88A045C7CC17AC2D\YBDTCZR6.EXE
del %SystemDrive%\USERS\МИХАИЛ\APPDATA\LOCAL\TEMP\853EFECEF8C64D1A88A045C7CC17AC2D\YBDTCZR6.EXE
delref %SystemDrive%\PROGRAM FILES\WINDOWS PORTABLE DEVICES\027NR3MUG082V4TYIGFN0TGS98I\W5XMMOUMGX.EXE
del %SystemDrive%\PROGRAM FILES\WINDOWS PORTABLE DEVICES\027NR3MUG082V4TYIGFN0TGS98I\W5XMMOUMGX.EXE
delref %SystemDrive%\PROGRAMDATA\33E4330F22264AC3A466597094302278\HMA4GAL8X9XDE.EXE
del %SystemDrive%\PROGRAMDATA\33E4330F22264AC3A466597094302278\HMA4GAL8X9XDE.EXE
delref HTTP://FURYERY.RU/?UTM_SOURCE=UOUA03&UTM_CONTENT=5C960E458AC6158314C6529E8F71F655&UTM_TERM=3A000774EE870968CF0BDE2C1F83CD8E&UTM_D=20170630
delall %SystemDrive%\PROGRAM FILES (X86)\YUBEALCKU\BJJPPYI.DLL
delall %SystemDrive%\PROGRAM FILES\CRAZYWARK - FREE BUILDER\CRAZYWARK - FREE BUILDER.DLL
delall %SystemDrive%\USERS\МИХАИЛ\APPDATA\ROAMING\EVENT MONITOR\EM.EXE

apply

deltmp
delref A9A33436-678B-4C9C-A211-7CC38785E79D\[CLSID]
delref 752073A1-23F2-4396-85F0-8FDB879ED0ED\[CLSID]
delref %SystemRoot%\SYSWOW64\COMPMGMTLAUNCHER.EXE
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {19916E01-B44E-4E31-94A4-4696DF46157B}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\[CLSID]
delref {0D012ABD-CEED-11D2-9C76-00105AA73033}\[CLSID]
delref {56A58823-AE99-11D5-B90B-0050DACD1F75}\[CLSID]
delref {E01D1C6A-4F40-11D3-8958-00105A272DCF}\[CLSID]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref TBS\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %SystemDrive%\PROGRAMDATA\MTA SAN ANDREAS ALL\COMMON\TEMP\FAIRPLAYKD.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\DAO\DAO360.DLL
delref %SystemRoot%\SYSWOW64\TAPILUA.DLL
delref %SystemRoot%\SYSWOW64\AEPROAM.DLL
delref %SystemRoot%\SYSWOW64\RSTRUI.EXE
delref %SystemRoot%\SYSWOW64\LISTSVC.DLL
delref %SystemRoot%\SYSWOW64\WBEM\NLMCIM.DLL
delref %SystemRoot%\SYSWOW64\WPCCPL.DLL
delref %SystemRoot%\SYSWOW64\GPSVC.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\IDLISTEN.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\SYSTEM\OLE DB\MSDAORA.DLL
delref G:\LENOVO_SUITE.EXE
;-------------------------------------------------------------

restart