выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v4.0.9 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFDJDJKKJOIOMAFNIHNOBKINNFJNNLHDG%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEIDJEEFDDHGEFEPLHDLEGOLDLGIODON%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DNECFMKPLPMINFJAGBLFABGGOMDPAAKAN%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DPJFKGJLNOCFAKOHEOAPICNKNOGLIPAPD%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\USERS\1\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PJFKGJLNOCFAKOHEOAPICNKNOGLIPAPD\2.0.1.15_1\СТАРТОВАЯ — ЯНДЕКС
delref E:\RUN.EXE
apply
deltmp
delref %SystemRoot%\SOFTWAREDISTRIBUTION\DOWNLOAD\FF856EFCFB81A4EF8D40BA81703E62D2\76AEF6089DDF086891F5839FC62FB63CABE1CC40-1
delref %SystemDrive%\USERS\1\APPDATA\LOCAL\TEMP\YUPDATE-VERSIONINFO-YABROWSER.XML
delref %SystemRoot%\EHOME\MCUPDATE
delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID]
delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID]
delref {7FA3A1C3-3C87-40DE-AC16-B6E2815A4CC8}\[CLSID]
delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID]
delref %SystemRoot%\EHOME\EHREC
delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID]
delref %SystemDrive%\USERS\1\APPDATA\LOCAL\TEMP\NS40DC891C\35D21339_STP\DOWNLOADER.EXE
delref %SystemRoot%\SYSWOW64\TBSSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\UMPO.DLL
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.EXE
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {6BF52A52-394A-11D3-B153-00C04F79FAA6}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {D27CDB6E-AE6D-11CF-96B8-444553540000}\[CLSID]
delref %SystemRoot%\SYSWOW64\WIN32K.SYS
delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\CHROME\ASWWEBREPCHROMESP.CRX
delref %SystemDrive%\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\CHROME\ASWWEBREPCHROME.CRX
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\55.0.2883.87\INSTALLER\CHRMSTP.EXE
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}\[CLSID]
delref {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}\[CLSID]
delref APPMGMT\[SERVICE]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref %SystemRoot%\GDRV.SYS
delref %SystemDrive%\PROGRAM FILES (X86)\GARENA PLUS\ROOM\SAFEDRV.SYS
delref %SystemDrive%\USERS\1\APPDATA\LOCAL\TEMP\GKERNEL.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE_64.DLL
delref %Sys32%\SHAREMEDIACPL.CPL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE_64.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.21.115\PSMACHINE.DLL
delref E:\CHECKVER.OCX
delref E:\DRIVERCDHTML.OCX
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.32.7\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.33.3\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.31.5\PSMACHINE.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\UPDATE\1.3.30.3\PSMACHINE.DLL
delref {2318C2B1-4965-11D4-9B18-009027A5CD4F}\[CLSID]
delref {AA58ED58-01DD-4D91-8333-CF10577473F7}\[CLSID]
delref {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\[CLSID]
delref %Sys32%\BLANK.HTM
delref %SystemDrive%\PROGRAM FILES\VKONTAKTEDJ\VKONTAKTEDJ.EXE
delref %SystemDrive%\PROGRAM FILES\VKONTAKTEDJ\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\HEARTHSTONE\HEARTHSTONE BETA LAUNCHER.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\TELETRADE MT4\TERMINAL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\WORLD OF WARCRAFT\WORLD OF WARCRAFT LAUNCHER.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER\METAEDITOR64.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER\TERMINAL64.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER 5\METAEDITOR64.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER 5\TERMINAL64.EXE
delref %SystemDrive%\PROGRAM FILES\METATRADER 5\UNINSTALL.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\TELETRADE MT4\METAEDITOR.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\TELETRADE MT4\UNINSTALL.EXE
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните сканирование (угроз) в Malwarebytes
|
