;uVS v3.87 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
OFFSGNSAVE
;------------------------autoscript---------------------------

hide %SystemDrive%\PROGRAM FILES (X86)\MSI AFTERBURNER\UNINSTALL.EXE
hide %SystemDrive%\PROGRAM FILES (X86)\THE KMPLAYER\KMPSETUP.EXE
hide %SystemDrive%\PROGRAM FILES (X86)\SOPCAST\UNINST.EXE
chklst
delvir

delref HTTP://ZENIGAMEBLINGER.ORG/

deldirex %SystemDrive%\PROGRAM FILES (X86)\ANYPROTECTEX

delref %SystemDrive%\PROGRAM FILES (X86)\WINZIP SYSTEM UTILITIES SUITE\WINZIPSSCHECKUPDATE.EXE

delref %SystemDrive%\PROGRAM FILES (X86)\WINZIP SYSTEM UTILITIES SUITE\WINZIPSS.EXE

delref 0C:\PROGRAM FILES\I2P\SCRIPTS\I2PPROXY.PAC

deldirex %SystemDrive%\USERS\IGNAT\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

deldirex %SystemDrive%\USERS\HOME\APPDATA\LOCALLOW\UNITY\WEBPLAYER\LOADER

delref HTTP://SEARCH.CONDUIT.COM/?GD=&CTID=CT3324790&OCTID=EB_ORIGINAL_CTID&ISID=M5EC7EE11-4D38-4F81-96C0-620F64604E27&SEARCHSOURCE=55&CUI=&UM=5&UP=SP1BBD56A9-D7E9-4524-B538-929958CCF997&SSPV=

delref %SystemDrive%\USERS\IGNAT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\1KQ57ZEB.DEFAULT\EXTENSIONS\HELPER-SIG@SAVEFROM.NET.XPI

delref HTTP://SEARCH.CONDUIT.COM/?GD=&CTID=CT3324790&OCTID=EB_ORIGINAL_CTID&ISID=M5EC7EE11-4D38-4F81-96C0-620F64604E27&SEARCHSOURCE=69&CUI=&SSPV=&LAY=1&UM=5&UP=SP1BBD56A9-D7E9-4524-B538-929958CCF997

delref HTTP://ZENIGAMEBLINGER.ORG

regt 27
; Time tasks
exec C:\ProgramData\TimeTasks\uninstall.exe
deltmp
delnfr
;-------------------------------------------------------------

restart

  

Task: {42C16185-ED8F-4401-A329-421C07FBAEA1} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask -> No File <==== ATTENTION
Task: {874A6552-C276-477F-9D95-7FA35A720F6C} - \GameNet -> No File <==== ATTENTION
Task: {9A7C2227-320B-4795-B3E8-FE1118AC56F0} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask -> No File <==== ATTENTION
Task: {DC8560F6-3A19-4CBF-A474-A23F2DE414A2} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask -> No File <==== ATTENTION
Task: {EC4F58C0-5765-4D96-B710-E05E9DE7FE6F} - \Microsoft\Windows\Media Center\PvrScheduleTask -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Microsoft:bqsYoAyrZjzMBDs4065s
AlternateDataStreams: C:\ProgramData\Microsoft:eAEwrkq1ghuXaTcrwa
AlternateDataStreams: C:\ProgramData\Microsoft:QBDKr7JtvyPRymAPyWvngqz
AlternateDataStreams: C:\Users\IGNAT\Cookies:oJTrdHgauYJi4FfzmshNknvKDs
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:bqsYoAyrZjzMBDs4065s
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:eAEwrkq1ghuXaTcrwa
AlternateDataStreams: C:\Users\Все пользователи\Microsoft:QBDKr7JtvyPRymAPyWvngqz
MSCONFIG\startupreg: amigo => C:\Users\IGNAT\AppData\Local\Amigo\Application\amigo.exe --no-startup-window
MSCONFIG\startupreg: CMD => cmd.exe /c start http://adverttraff.org && exit
MSCONFIG\startupreg: GameCenterMailRu => "C:\Users\IGNAT\AppData\Local\Mail.Ru\GameCenter\GameCenter@Mail.Ru.exe" -autostart
MSCONFIG\startupreg: MailRuUpdater => C:\Users\IGNAT\AppData\Local\MailRu\MailRuUpdater.exe
MSCONFIG\startupreg: removeBrowserTabSearchdatamngr => cmd.exe /c RD /S /Q "C:\Program Files (x86)\Browser Tab Search by Ask"
AppInit_DLLs-x32:  => No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2575969489-1904705891-165196895-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.rambler.ru/?utm_source=r57.sub3&utm_medium=distribution&utm_content=e08&utm_campaign=4w17
HKU\S-1-5-21-2575969489-1904705891-165196895-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=openpart
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKLM-x32 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = 
SearchScopes: HKU\S-1-5-21-2575969489-1904705891-165196895-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
SearchScopes: HKU\S-1-5-21-2575969489-1904705891-165196895-1000 -> {6FFAAA5E-C39C-45DE-922B-532A4B081E4D} URL = hxxp://nova.rambler.ru/search?query={searchTerms}&utm_source=r57.sub3&utm_medium=distribution&utm_content=e09&utm_campaign=4w17
SearchScopes: HKU\S-1-5-21-2575969489-1904705891-165196895-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg
FF SelectedSearchEngine: Поиск@Mail.Ru
FF Homepage: mail.ru
FF Keyword.URL: hxxp://go.mail.ru/search?fr=ntg&q=
FF Plugin HKU\S-1-5-21-2575969489-1904705891-165196895-1000: @mail.ru/GameCenter -> C:\Users\IGNAT\AppData\Local\Mail.Ru\GameCenter\NPDetector.dll [No File]
FF Extension: VKontakte.ru Downloader - C:\Users\IGNAT\AppData\Roaming\Mozilla\Firefox\Profiles\1kq57zeb.default\extensions\vk@sergeykolosov.mp.xpi [2016-01-11]
FF Extension: MEGA - C:\Users\IGNAT\AppData\Roaming\Mozilla\Firefox\Profiles\1kq57zeb.default\Extensions\firefox@mega.co.nz.xpi [2016-02-17]
CHR StartupUrls: Default -> "hxxp://go.mail.ru/?chverfix=1&fr=chverfix_sg","hxxp://www.rambler.ru/?utm_source=r57.sub3&utm_medium=distribution&utm_content=e08&utm_campaign=4w17"
EmptyTemp:
Reboot: