;uVS v3.87 [http://dsrt.dyndns.org]
;Target OS: NTv6.3
v385c
OFFSGNSAVE
zoo %SystemDrive%\PROGRAMDATA\LWDSMANPROL\WDSMANPRO.EXE
addsgn 1AE6AB9A5583338CF42BF9E7EFBC3615AEC6D8E202863B740E024E6D53104AB2551FF8AF31D7F54A2B808B256366E2BF7DDE9B75A67E593B2E77A4AE3E862273 8 Win32/ELEX

addsgn 1AF6609A5583338CF42BFB3A88370719C5CAFC9C88599B10C4C32DDB4CD671B3561F2BAB25559DCA1604ECDE461610A308D78273BD97AC2C2D2ECC26C306E29B 8 Win32/Toolbar.Neobar

zoo %SystemDrive%\PROGRAM FILES (X86)\VK OK ADBLOCK\4E82NDX.EXE
hide %SystemDrive%\PROGRAM FILES (X86)\IMAGE-LINE\DOWNLOADER\UNINSTALL.EXE
hide %SystemDrive%\PROGRAM FILES (X86)\ZONA\ZONA.EXE
hide %SystemDrive%\PROGRAM FILES\MCAFEE SECURITY SCAN\UNINSTALL.EXE
hide %SystemDrive%\PROGRAM FILES (X86)\SOPCAST\UNINST.EXE
;------------------------autoscript---------------------------

chklst
delvir

delref HTTP://OPATOLO.RU/?UTM_SOURCE=UOUA03N&UTM_CONTENT=53EC9CBA11C4C68DB945B0FAEDD19CDA&UTM_TERM=C06294B6C23E823724E1752F92FB9E1E

deldirex %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\SYSTEMDIR

delref {02478D38-C3F9-4EFB-9B51-7695ECA05670}\[CLSID]

deldirex %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\KOMETA\STARTBUTTON

delref %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\BGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB\6.0.1_0\ПОИСК MAIL.RU

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DLBJJFIIHGFEGNIOLCKPHPNFAOKDKBMDM%26INSTALLSOURCE%3DONDEMAND%26UC

delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC

deldirex %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\KOMETA\PANEL

deldirex %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\KOMETA\APPLICATION

deldirex %SystemDrive%\USERS\АЛЕКСАНДР\APPDATA\LOCAL\KOMETA\PANEL\1.0.0.775

regt 27
; McAfee Security Scan Plus
exec C:\Program Files\McAfee Security Scan\uninstall.exe
deltmp
delnfr
;-------------------------------------------------------------

restart

  

Task: {1A134778-7DAC-417D-83EE-F32BFD470239} - \Lenovo\Lenovo Customer Feedback Program -> No File <==== ATTENTION
Task: {2C7F582B-BBE4-4E21-8FFF-C6A2CF78A09D} - \{D1327A3D-6ADF-4C49-BE9F-8D34B42993A2} -> No File <==== ATTENTION
Task: {47BFE674-5DFA-4395-B88C-47D28D6E5597} - \Microsoft\Windows\Maintenance\WinSAT -> No File <==== ATTENTION
Task: {51D996C1-D12D-4C42-BD5C-C587CF9B09BA} - \nethost task -> No File <==== ATTENTION
Task: {5437E367-A5D8-40E7-9FEF-E6984C706409} - \Microsoft\Windows\SafeBrowser -> No File <==== ATTENTION
Task: {5DD2D9D3-2929-4B9B-A2A4-4812F5220B1F} - \Microsoft\Windows\Adobe Flash Player NPAPI -> No File <==== ATTENTION
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> No File <==== ATTENTION
Task: {7A0C5E7E-27C0-4108-B273-452DDDDAA34E} - \Lenovo\Experience Improvement -> No File <==== ATTENTION
Task: {7A3A60E2-EFB5-44AA-9094-CC4B4CB15013} - \Microsoft\Windows\extsetup -> No File <==== ATTENTION
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> No File <==== ATTENTION
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> No File <==== ATTENTION
Task: {DF45342D-B9DF-415A-AA54-212938933AAE} - \Microsoft\Windows\DBA74445-4F8E-43C5-BF42-589F9626B9D8 -> No File <==== ATTENTION
Task: {F61C1098-6385-4992-9119-CE0F68340314} - \Microsoft\Windows\Servicing\StartComponentCleanup -> No File <==== ATTENTION
HKLM\...\StartupApproved\StartupFolder: => "McAfee Security Scan Plus.lnk"
HKLM\...\StartupApproved\Run: => "SmartAudio"
HKLM\...\StartupApproved\Run32: => "multibar.exe"
HKLM\...\StartupApproved\Run32: => "ZaxarLoader"
HKLM\...\StartupApproved\Run32: => "BaiduAnTray"
HKLM\...\StartupApproved\Run32: => "Kinoroom Browser"
HKLM\...\StartupApproved\Run32: => "KRB Updater Utility"
HKLM\...\StartupApproved\Run32: => "SmartAudio"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "baidu"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "KometaLaunchPanel"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "musichelp"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "BaiduClient"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "amigo"
HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\...\StartupApproved\Run: => "StartButton"
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-1381319607-1688735436-2332824748-1002\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
FF DefaultSearchEngine: Поиск@Mail.Ru
FF DefaultSearchEngine: Поиск@Mail.Ru
FF SelectedSearchEngine: Поиск@Mail.Ru
FF Homepage: hxxp://opatolo.ru/?utm_content=83d5920a52d67260f4213f8bddf9126c&utm_source=startpm&utm_term=C06294B6C23E823724E1752F92FB9E1E
FF Extension: No Name - C:\Users\Александр\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\exapp@tele-come.org [2014-12-30] [not signed]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => not found
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\akimgimeeoiognljlfchpbkpfbmeapkh [2015-04-29]
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\bhnpmdabjgpimmnbmhefncbghknfegog [2015-06-26]
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-25]
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\dmglolhoplikcoamfgjgammjbgchgjdd [2015-05-12]
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\ihmgiclibbndffejedjimfjmfoabpcke [2015-07-06]
OPR Extension: (SocialLife Suit for Google Chrome™) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\mclkkofklkfljcocdinagocijmpgbhab [2015-07-03]
OPR Extension: (PhoenixGuard - бесплатный антивирусный тулбар) - C:\Users\Александр\AppData\Roaming\Opera Software\Opera Stable\Extensions\pleoihkpdomoijdpaibdciidfoeedamm [2014-10-30]
EmptyTemp:
Reboot: