;uVS v3.85.17 [http://dsrt.dyndns.org]
;Target OS: NTv6.3
v385c
OFFSGNSAVE
; C:\USERS\ВЛАДИМИР\APPDATA\ROAMING\AIMP3\CACHES\MDM
addsgn A7659219B9728B762FD6AEB1643707C541D8FC1EED07E087D04A203FBCDED0B44745C39EC1B5FBD97E09611CAA1EE822198DE8BBAA3A20BC78FE41AC2B1EE577 64 Win32/BitCoinMiner.BY [ESET]

; C:\PROGRAM FILES (X86)\MICROSOFT DATA\INSTALL_ADDONS.EXE
addsgn 1ABB609B5583C58CF42B254E3143FE86C9AA77B381AC48128D9A7BACCE8A71C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 adware.vir

; C:\USERS\ВЛАДИМИР\APPDATA\LOCAL\SYSTEMDIR\NETHOST.EXE
addsgn 1A91B09A5583C58CF42BC4BD0C384D1D2062257889FA2C870CBE218F905D044018E0CCC2FE6E5A3C3368A78546168EFA6BDFE872BD36112C2DF46CD02EB22273 8 Win32/RuKometa.F [ESET]

; C:\USERS\ВЛАДИМИР\APPDATA\LOCAL\VTOPE\VTOPE.EXE
addsgn 1A04739A55834C720BD4C4A50C00FF5E25623AF789FA9C1D65C33AA928D7384C2CA01BD45BA99D2D8A98849F469D19FE4E2056267387B0A7E74464DFC8B72CF6 8 virus.net
chklst
delvir
delref HTTP://4GAME.COM/?CLIENT-APP=V2
delref HTTP://JAVA.COM/
delref HTTP://JAVA.COM/HELP
delref HTTP://MAPRUT.RU/?UTM_SOURCE=STARTPAGE03&UTM_CONTENT=8B57E55A9FA404F8E9335910C2B7269E
delref OVERBTC12.
delref A9A33436-678B-4C9C-A211-7CC38785E79D\[CLSID]
delref 752073A1-23F2-4396-85F0-8FDB879ED0ED\[CLSID]
delall %SystemDrive%\PROGRAM FILES (X86)\WINTOFLASH SUGGESTOR\SMBARBROKER.EXE
delall %SystemDrive%\PROGRAM FILES (X86)\WINTOFLASH SUGGESTOR\WINTOFLASHSUGGESTOR.DLL
delall %SystemDrive%\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\VTOPE\VTOPE.LNK
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\39.0.2171.95\RESOURCES\GAIA_AUTH\GAIAAUTHEXTENSION
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\42.0.2311.90\RESOURCES\CRYPTOTOKEN\CRYPTOTOKENEXTENSION
delref %SystemDrive%\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\42.0.2311.90\RESOURCES\FEEDBACK\FEEDBACK
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\ACAOAKIAMFEIDCMGOOCLGELEEJKBAECF\1.2.5_0\WINTOFLASH SUGGESTOR
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GIGHMMPIOBKLFEPJOCNAMGKKBIGLIDOM\2.29_0\BETAFISH ADBLOCKER
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\HANJIAJGNONAOBDLKLNCDJDMPBOMLHOA\3.0.25_0\MUSICSIG VKONTAKTE
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\LCCEKMODGKLAEPJEOFJDJPBMINLLAJKG\0.3.0.2_0\CHROME HOTWORD SHARED MODULE
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\MFMJPFOGGIKOLKFILOFBPGCNHDCGAHIB\3.0.2_0\ДОМАШНЯЯ СТРАНИЦА MAIL.RU
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PFJGIBHMCGNCMJHDODPAOLFBJPJJAJAL\3.0.2_0\ПОИСК MAIL.RU
delref %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PGAIDLFGJKMEENDHKNAFAHPPLLBNIEJM\3.0.2_0\ВИЗУАЛЬНЫЕ ЗАКЛАДКИ MAIL.RU
delall %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\MAILRU.XML
delall %SystemDrive%\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\SEARCHPLUGINS\OZONRU.XML
exec32 "C:\Program Files (x86)\VTope\unins000.exe"
exec32 "C:\Program Files (x86)\WinToFlash Suggestor\Uninstall.exe"
deldir %SystemDrive%\USERS\ВЛАДИМИР\APPDATA\LOCAL\VTOPE
deldir %SystemDrive%\PROGRAM FILES (X86)\WINTOFLASH SUGGESTOR
deldir %SystemDrive%\PROGRAM FILES (X86)\VTOPE
deltmp
delnfr
regt 27
restart