;uVS v3.86.7 [http://dsrt.dyndns.org]
;Target OS: NTv10.0
v385c
OFFSGNSAVE
zoo %SystemDrive%\USERS\АРИНА_2\APPDATA\ROAMING\VG01_2\S_INST.EXE
addsgn A7679B235E6A4C7261D4C4B12DBDEBBDFDFFB9F6613DF9827AF005E938F4C80923733C675ADCBDA1A7887F60C3D637A5F49A04B5503E826A2D76A42FC78B779B 16 Trojan.Fakealert.47332 [DrWeb]

zoo %SystemDrive%\USERS\АРИНА_2\APPDATA\ROAMING\APPLE COMPUTER\REVERSED\STEAM.EXE
addsgn A7659219B9728B762FD6AEB164370795F0D8FC1EED07E087D04A203FBCDED084F645C39EC1B5FBD97E09611CAA1EE852A88DE8BBAA3A20BC78FE41AC2B1EE577 17 Win32/BitCoinMiner.BY [ESET-NOD32]

zoo %SystemDrive%\USERS\АРИНА_2\APPDATA\LOCAL\MEDIAGET2\MEDIAGET-UNINSTALLER.EXE
addsgn 9252771A116AC1CC0B44554E33231995AF8CBA7E8EBD1EA3F0C44EA2D3388D5DF8652EEF3F559D492A5BF198CD08CA1481CE336395DB6B5F26028CA4D985CC8F 14 Win32:FakeSys-BF [PUP]

delall %SystemRoot%\INF\IP.EXE
;------------------------autoscript---------------------------

chklst
delvir

delref OVERCOINVLAD.

delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID]

deldirex %SystemDrive%\USERS\АРИНА_2\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBKNBNAPADDJDNBILPMLACDKJDKJMBJHD%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFDJDJKKJOIOMAFNIHNOBKINNFJNNLHDG%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTP://WWW.SWEET-PAGE.COM/?TYPE=HP&TS=1407521517&FROM=COR&UID=ST1000DM003-1CH162_Z1D3V6QN

delref %SystemDrive%\USERS\АРИНА_2\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE\1.0.7_0\СТАРТОВАЯ — ЯНДЕКС

deldirex %SystemDrive%\USERS\АРИНА_2\APPDATA\LOCAL\MEDIAGET2

deldirex %SystemDrive%\USERS\АРИНА_2\APPDATA\LOCAL\UNITY\WEBPLAYER

del %SystemDrive%\PROGRAM FILES (X86)\OPERA\LAUNCHER.URL

regt 28
regt 29
deltmp
delnfr
;-------------------------------------------------------------

restart