;uVS v4.11 [http://dsrt.dyndns.org:8888]
;Target OS: NTv10.0
v400c
OFFSGNSAVE
addsgn BA6F9BB2BDD5FF720B9C2D754C2124FBDA75303A02FF85B08FC3813792F5BB0DD4C78774FE1196886F09811A8E1C4939355C045ABD5D982C2D3F21EFB30C9B65 8 Trojan.AutoIt.710 [DrWeb] 7

addsgn 9204749A556AA5990F89EBE4A7201305258A17AB3217E0877AC0183DBBD6412623947EDF3A559D49A21D0C9B4616467FB6DCE872D85F24282D77F4D052AF2D73 31 Program.RemoteAdmin.753 [DrWeb] 7

chklst
delvir

regt 14
regt 18
regt 38
deltmp
;---------command-block---------
delref HTTP://STARTMAIN.RU/
delref %SystemDrive%\USERS\BIGOZ\APPDATA\LOCAL\TEMP\WCTEF29.TMP
delref %SystemDrive%\PROGRAMDATA\WINDOWSTASK\WINLOGON.EXE
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\17.3.7294.0108\FILESYNCSHELL.DLL
delref %SystemDrive%\USERS\DEFAULTUSER0.DESKTOP-5UEBRLN\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\20.052.0311.0011\FILESYNCSHELL.DLL
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\APPLICATION\BROWSER.EXE
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\17.3.7294.0108\FILECOAUTH.EXE
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVE.EXE
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\17.3.7294.0108\FILECOAUTHLIB.DLL
delref %SystemDrive%\USERS\DEFAULTUSER0.DESKTOP-5UEBRLN\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\20.052.0311.0011\FILECOAUTH.EXE
delref %SystemDrive%\USERS\DEFAULTUSER0.DESKTOP-5UEBRLN\APPDATA\LOCAL\TEMP\{E9513610-F218-4DDA-B954-2C7E6BA7CABB}\IDRIVER.NONELEVATED.EXE
delref %SystemDrive%\USERS\BIGOZ\APPDATA\LOCAL\TEMP\{E9513610-F218-4DDA-B954-2C7E6BA7CABB}\IDRIVER.NONELEVATED.EXE
delref %SystemDrive%\PROGRAM FILES\REMPL\DISKTOAST.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.35.442\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES\LDPLAYERBOX\VBOXPROXYSTUB.DLL
delref %SystemDrive%\PROGRAM FILES\LDPLAYERBOX\VBOXC.DLL
delref %SystemDrive%\PROGRAM FILES\LDPLAYERBOX\LDVBOXSVC.EXE
delref %SystemDrive%\PROGRAM FILES\REMPL\STRGSNSADDONS.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.127.15\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\PSMACHINE.DLL
delref %SystemRoot%\SYSWOW64\SPEECH_ONECORE\COMMON\SAPI_EXTENSIONS.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE\1.3.127.15\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.7\GOOGLEUPDATEBROKER.EXE
delref %SystemDrive%\USERS\DEFAULTUSER0\APPDATA\LOCAL\YANDEX\YANDEXBROWSER\APPLICATION\BROWSER.EXE
apply
restart