;uVS v3.87 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
OFFSGNSAVE
zoo %SystemDrive%\PROGRAMDATA\SWDMS\WDMAN.EXE
addsgn 1A11CF9A5583338CF42B627DA804DEC9E946303ADEAC940CA1D34EF074C2FA30071B4896B5849E8F107EF2977DEE467815DCE8725A6095E42433A42EB401D1D7 8 Adware.Mutabaha.1051 [DrWeb]

delall %SystemDrive%\PROGRAMDATA\SWDMS\WDMAN.EXE
delall %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\TEMP\ICREINSTALL_9CBD.TMP.EXE
delall %SystemDrive%\USERS\PUBLIC\DOWNLOADS\МУЗЫКА\PESNYA_PRO_KOTA_-_MOJ_KOT_LYUBIT_HIP-HOP_(IPLAYER.FM).EXE
delall %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\YEARQUADFAN.EXE
delref HTTP:\\WWW.ISTARTPAGEING.COM\?TYPE=SC&TS=1458322936&Z=CB887C0F61F3C14F93F6282G5Z6W6B7CAOEO3TDC5B&FROM=CMI&UID=ST3750525AS_6VPJTXTPXXXX6VPJTXTP
delref %SystemDrive%\PROGRAMDATA\RONZAPS\FF.HP
delref %SystemDrive%\PROGRAMDATA\RONZAPS\FF.NT
delref HTTP://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?P=MKO_AWFZXIPYRAHDGIJVKXLYIP4NYE17AVLWUCBJWJ6MZZJCVF7BT8CJPHPLH1VAQ90IG-QW9BOE4S5WV-VRCBSVSNSOS2ZRQD10MZM4AUO5CTKUG-NWNPUNXGPDHM0RVIL0P1XZZVWSFFHMAZ4P1DUWZKKP-T8TLKLSJ0A3GOHXYOAWXMPL4NLCHHKM57LNO48FUOXXIGPQ
delref HTTP://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?P=MKO_AWFZXIPYRAHDGIJVKXLYIP4NYE17AVLWUCBJWJ6MZZJCVF7BT8CJPHPLH1VAQ90IG-QW9BOE4S5WV-VRCBSVSNSOS2ZRQD10MZM4AUO5CTKUG-V9SBRBXALNEIZNPKNT4M-CNME4RM_ARLRKU_84Z8JVSZAFEX0-_P1BLVOBIMY8CZ2NTBUEJWQ2PBP
delref HTTP://VIRALIZEIT.NET/RANDOM
delref HTTP://WWW.DUBA.COM/?UN_449343_3345
delref HTTP://WWW.YESSEARCHES.COM/?TS=AHEPC3ALCHMTAE..&V=20160315&UID=3BE7C38BEDBE2750C3DD2DEF8B50DFDD&PTID=SQR1&MODE=SCRP
delref HTTPS://CLIENTS2.GOOGLE.COM/CR/REPORT
delall %SystemDrive%\PROGRAM FILES\38E4F920-1458316065-11DF-AF28-7071BCBF89C5\KNSS1810.TMPFS
delall %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\38E4F920-1458344492-11DF-AF28-7071BCBF89C5\QNSC364E.TMP
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\FCGNIGMOFEKCLLGBIEJHMIGGGMGEHKIP\1.1.7_0\WIKI-SEARCH.ME
delref %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\OOEBKLGPFNBCNPOKAHMDIDGBMLCDEPKM\3.1_0\电脑管家上网防护
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDLJDACFOJGIKOGLDJFFNKDCIELNKLKCE%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFCGNIGMOFEKCLLGBIEJHMIGGGMGEHKIP%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref %SystemDrive%\PROGRAMDATA\RONZAP\SALTCOM.DLL
delref %SystemDrive%\PROGRAMDATA\\RONZAP\\RONZAP.EXE
regt 12
regt 28
regt 29
deltmp
delnfr
restart

HKLM\...\Run: [win_en_77] => "C:\Program Files\win_en_77\win_en_77.exe"
HKLM\...\Run: [sun21] => [X]
HKLM\...\Run: [rec_ru_229] => "C:\Program Files\rec_ru_229\rec_ru_229.exe"
AppInit_DLLs: C:\ProgramData\Ronzap\Saltcom.dll => C:\ProgramData\Ronzap\Saltcom.dll [257536 2016-03-18] ()
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.duba.com/?un_449343_3345
URLSearchHook: [S-1-5-21-1423089912-347344423-2147407009-500] ATTENTION => Default URLSearchHook is missing
SearchScopes: HKLM -> DefaultScope value is missing
R2 ContentProtectorUpdate; C:\Program Files\ContentProtector\ContentProtectorUpdate.exe [225536 2016-03-10] ("Artex Management S. A.")
R2 DrWebEngine; C:\Program Files\DrWeb AV-Desk\dwengine.exe [1973320 2014-10-30] (Doctor Web, Ltd.)
R2 Ronzap; C:\ProgramData\\Ronzap\\Ronzap.exe [774144 2016-03-18] () [File not signed]
S3 32177D4; C:\Windows\TEMP\32177D4.sys [207920 2015-11-20] (Doctor Web, Ltd.)
S3 3688C5C; C:\Windows\TEMP\3688C5C.sys [207920 2015-10-11] (Doctor Web, Ltd.)
S3 7076AB2; C:\Windows\TEMP\7076AB2.sys [207920 2015-04-26] (Doctor Web, Ltd.)
Task: {568BE81D-61B4-4864-A265-F79F44DD62DE} - System32\Tasks\{BCFBCFED-6541-4BA1-849C-CA493D6DAEE1} => pcalua.exe -a "C:\Program Files\Common Files\Dingtough\uninstall.exe" -c shuz -f "C:\Program Files\Common Files\Dingtough\uninstall.dat" -a uninstallme FACB5928-0AE5-4851-A91B-BF5AFB239CBE DeviceId=1fe9b4e2-5e1f-5934-edc5-b55481235bad BarcodeId=50027003 ChannelId=3 DistributerName=APSnapdoAMRev
Task: {61EA8446-1CBD-417B-A394-5E57EA22C896} - \{0FA9D1C4-FE19-4F3C-8721-4655B30C271E} -> No File <==== ATTENTION
2016-03-18 22:43 - 2016-03-18 22:43 - 07556203 _____ () C:\Program Files\NewExt\jsinjector.exe
EmptyTemp:
Reboot:

;uVS v3.87 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
v385c
OFFSGNSAVE
delall %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\AMIGO\APPLICATION\AMIGO.EXE
delall %SystemDrive%\USERS\АДМИНИСТРАТОР\APPDATA\LOCAL\TEMP\ICREINSTALL_7FC9.TMP.EXE
deltmp
delnfr
restart