;uVS v3.87 [http://dsrt.dyndns.org]
;Target OS: NTv6.2
v385c
OFFSGNSAVE
delref %SystemDrive%\PROGRAM FILES (X86)\00000000-1457085074-0000-0807-060504030201\HNSQA5BE.TMP
delref %SystemDrive%\PROGRAM FILES (X86)\00000000-1457085074-0000-0807-060504030201\JNSG8C34.TMP
delall %SystemDrive%\USERS\GRE4\APPDATA\ROAMING\MICRON\MILK.EXE
delref %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\00000000-1457099608-0000-0807-060504030201\SNSB4141.TMP
delall %SystemDrive%\USERS\GRE4\APPDATA\ROAMING\PRICEFOUNTAINUPDATEVER\UPDATEPROC\UPDATETASK.EXE
delref %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\CNCGOHEPIHCEKKLOKHBHIBLHFCMIPBDH\1.0.9_0\ПОИСК  ЯНДЕКСA
deldir %SystemDrive%\PROGRAM FILES (X86)\00000000-1457085074-0000-0807-060504030201
deldir %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\00000000-1457099608-0000-0807-060504030201
zoo %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\BLACOUNT\STUB.EXE
delall %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\BLACOUNT\STUB.EXE
delref HTTP://COSMOSEARCH.RU/?RI=1&RSID=955D15E423F84206FCDFC39B161011FD&Q={SEARCHTERMS}
delref HTTP://OPATOLO.RU/?UTM_SOURCE=UOUA03&UTM_CONTENT=53EC9CBA11C4C68DB945B0FAEDD19CDA&UTM_TERM=E31E44199A461173D14CB0664D2599C6&UTM_D=20160217
delref HTTP://PLARIUM.COM/PLAY/RU/SPARTA/001_TOP?ADCAMPAIGN=85539&CLICKID=TDTD0ETDYE0DTAYC0F0EZZ0ETB0ETD0D&PUBLISHERID=104
delall %SystemDrive%\PROGRAMDATA\KRB UPDATER UTILITY\KRBUPDATER-UTILITY.EXE
delref %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\ECLJAPGCEBEGHDGFJACLDOMHCNLEMKMK\0.0.0.7_0\BLACOUNT
delref %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\LBBNGLMAEFMPHKJGHLPOBGCLMCFLHFCC\2.0_0\WORD COUNT
delref %SystemDrive%\USERS\GRE4\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PJLDCFJMNLLHMGJCLECDNFAMPINOOMAN\13.0.1.4190_1\АНТИ-БАННЕР
regt 27
regt 28
regt 29
deltmp
delnfr
restart
czoo

Files: 795

RiskWare.IStealer, C:\ProgramData\KMSAutoS\bin\KMSSS.exe, , [3720d5b09efb71c576a2f871fb07c33d], 
HackTool.AutoKMS, C:\ProgramData\KMSAutoS\KMSAuto Net.exe, , [98bf6b1a41587abc7b8562d6f808f30d], 
ackTool.AutoKMS, C:\Program Files\KMSAuto Net.exe, , [1e398500cecbd85e5da31b1d6a965da3], 
CrackTool.KMSPico, C:\Program Files\KMSnano\KMSELDI.exe, , [a5b215704c4d4de9fe270001bf4355ab],

Папка Найдено : C:\Program Files (x86)\Mail.Ru
Папка Найдено : C:\ProgramData\Mail.Ru
Папка Найдено : C:\Users\Gre4\AppData\Local\Mail.Ru
Папка Найдено : C:\Users\Gre4\AppData\Local\MailRu

Файл Найдено : C:\Users\Gre4\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\vb@yandex.ru.json
Файл Найдено : C:\Users\Gre4\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\staged\yasearch@yandex.ru.json
Файл Найдено : C:\Users\Gre4\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\mailru.xml

CHR HKU\S-1-5-21-3652924417-3009240121-1209998295-1001\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
Toolbar: HKU\S-1-5-21-3652924417-3009240121-1209998295-1001 -> No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} -  No File
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR NewTab: Default -> "chrome-extension://oelpkepjlgmehajehfeicfbjdiobdkfj/visual-bookmarks.html","chrome-extension://aeembeejekghkopiabadonpmfpigojok/visual-bookmarks.html","chrome-extension://pnooffjhclkocplopffdbcdghmiffhji/visual-bookmarks.html"
CHR HKLM-x32\...\Chrome\Extension: [aeembeejekghkopiabadonpmfpigojok] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bejnpnkhfgfkcpgikiinojlmdcjimobi] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bgcifljfapbhgiehkjlckfjmgeojijcb] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cpegcopcfajiiibidlaelhjjblpefbjk] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fdjdjkkjoiomafnihnobkinnfjnnlhdg] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [geidjeefddhgefeplhdlegoldlgiodon] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ilamgbdaebkbpkkmfmmfbnaamkhijdek] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lbjjfiihgfegniolckphpnfaokdkbmdm] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ofdgafmdegfkhfdfkmllfefmcmcjllec] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pnooffjhclkocplopffdbcdghmiffhji] - hxxps://clients2.google.com/service/update2/crx
Task: {31660644-1E24-46F2-82E8-3EE9C5280811} - \Microsoft\Windows\A6E8983BE-DF7D-465D-9469-E47DEAEFF106 -> No File <==== ATTENTION
Task: {8D8E4B9B-1AFE-49BD-8431-C1C868C39DE6} - \Microsoft\Windows\6E8983BE-DF7D-465D-9469-E47DEAEFF106 -> No File <==== ATTENTION
Task: {980B8870-DFB6-48FF-A42C-6E8BAA404CE1} - \{A8BB432F-3619-4F84-B417-77DE71389180} -> No File <==== ATTENTION
Task: {C0555704-9C5B-4429-8CDC-03FF1FB785BE} - \Sparta W2 -> No File <==== ATTENTION
Task: {DAB0017A-63AC-47E0-BED7-92DA9D8BACC4} - \Sparta W1 -> No File <==== ATTENTION
Task: {EAC62EBF-3A37-4DD6-B2B7-534D120472BE} - \Microsoft\Windows\KRBUUS\KRB Updater Utility Service -> No File <==== ATTENTION
Task: {F8CB9715-5515-464A-916B-90EA5D3FC5A7} - \Kinoroom Browser -> No File <==== ATTENTION
EmptyTemp:
Reboot: