;uVS v3.76 BETA5 script [http://dsrt.dyndns.org]
;Target OS: NTv5.1
;OFFSGNSAVE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\TEMP\ESPHOST.EXE
addsgn 71006B5D514E4E720BD451A4ACAB5105CDC1010976776B5E854E799B50D6714C82F7A0143EAA7DC0DD0D38B8461649FADC0B8B31552550BCBDE734BF5796B2E3 8 Siggen

delall %SystemDrive%\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\TEMP\ESPHOST.EXE
delall %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\ICQ\ICQNEWTAB\NEWTAB.HTML
deltmp
delnfr
czoo
restart

begin
if FileExists(GetAVZDirectory + 'log\avz_log.txt') Then DeleteFile(GetAVZDirectory  + 'log\avz_log.txt');
 If DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', GetAVZDirectory +'ScanVuln.txt') Then ExecuteScript('ScanVuln.txt')
 Else ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
 if FileExists(GetAVZDirectory + 'log\avz_log.txt') Then ExecuteFile('notepad.exe', GetAVZDirectory + 'log\avz_log.txt', 1, 0, false)
 else MessageDlg('Часто используемые уязвимости не обнаружены.', mtInformation, mbOk, 0);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantineEx(True);
 DelCLSID('{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\esphost.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\esphost.exe','');
 DeleteFile('c:\docume~1\admin\locals~1\temp\esphost.exe');
 BC_DeleteSvc('AVGIDSErHrxpx');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\AVGIDSxx.sys');
 BC_DeleteSvc('AvgLdx86');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\avgldx86.sys');
 BC_DeleteSvc('AvgMFx86');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\avgmfx86.sys');
 BC_DeleteSvc('AvgRKx86');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\avgrkx86.sys');
 BC_DeleteSvc('AvgTdiX');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\avgtdix.sys');
 DeleteFile('C:\PROGRA~1\AVG\AVG9\avgameh.dll');
 DelWinlogonNotifyByKeyName('avgrsstarter');
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('SCU',2,2,true);
BC_Activate;
RebootWindows(true);
end.