;uVS v3.73 script [http://dsrt.dyndns.org]

; C:\WINDOWS\PPPUE.SYS
addsgn A76D8B9A556ACC01098C6DE98C2EEDFADA8EF9F288FA1E909443C5BC29BF08651A3EC132C0123288D2B9BDE62F6F60C354DDDDC9DCF71149D13EC2518E605ECC 8 Rootkit.SYS

delref %SystemDrive%\DOCUMENTS AND SETTINGS\ADMINISTRATOR\APPLICATION DATA\NETPROTOCOL.EXE
; C:\WINDOWS\APPPATCH\LPGSXU.EXE
addsgn A7679BF0AA024C130BC4C6754EC80261848AFCF689AA7BF1A0C3C5BC50559D14704194DE5BBD625C13E0848F75C4C32EF4CAACFC51CA3BE4AC965B2FC706AB7E 16 Spy.Shiz

zoo %SystemRoot%\APPPATCH\LPGSXU.EXE
delall %SystemRoot%\APPPATCH\LPGSXU.EXE
delref HTTP://WWW.MAIL.RU/CNT/5087
delref HTTP://WWW.MAIL.RU/CNT/5089
deltmp
delnfr
regt 1
regt 2
regt 3
regt 13
regt 14
regt 12
regt 18
regt 17
czoo
sreg
delref %SystemRoot%\PPPUE.SYS
areg

Объекты реестра заражены:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Зараженные файлы:
c:\system volume information\_restore{eb64011f-253d-4bfd-8ec9-3a66327e41d3}\RP19\A0005743.exe (Trojan.Downloader.BH) -> No action taken.
c:\system volume information\_restore{eb64011f-253d-4bfd-8ec9-3a66327e41d3}\RP19\A0005759.exe (Trojan.Downloader.BH) -> No action taken.
c:\WINDOWS\system32\greenfields.scr (Malware.Packer.Gen) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\14\6c60c0e-735e3df4 (Trojan.Downloader.BH) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\20\5fde6314-1c32d350 (Trojan.Downloader.BH) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\33\36fa2561-535116cf (Trojan.Downloader.BH) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\50\b793f32-31adcb74 (Trojan.Downloader.BH) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\9\42ed0849-45d79972 (Trojan.Dropper) -> No action taken.
c:\documents and settings\administrator\application data\Sun\Java\deployment\cache\6.0\9\47c140c9-48bb3447 (Trojan.Downloader.BH) -> No action taken.

begin
 if FileExists(GetAVZDirectory + 'log\avz_log.txt') Then DeleteFile('log\avz_log.txt');
 If DownloadFile('http://dataforce.ru/~kad/ScanVuln.txt', GetAVZDirectory +'ScanVuln.txt') Then ExecuteScript('ScanVuln.txt')
 Else ShowMessage('Невозможно загрузить скрипт AVZ для обнаружения наиболее часто используемых уязвимостей!');
 if FileExists(GetAVZDirectory + 'log\avz_log.txt') Then ExecuteFile('notepad.exe', GetAVZDirectory + 'log\avz_log.txt', 1, 0, false);
ExitAVZ;
end.