;uVS v3.75 script [http://dsrt.dyndns.org]
;Target OS: NTv6.1

zoo %Sys32%\TYEUWKF.DLL
addsgn A7679BC903E1117A5C5FDBBDE13E997835FFF575B40EDC79E9C32E9AD328703826943D554B773C49E281E81A866240AD2B8C17A2D01AC4207A21F7C7CFF9DD8C 64 majachok.0601

delall %SystemDrive%\USERS\BUHGALTER\APPDATA\ROAMING\TASKHOST.EXE
delref %Sys32%\TYEUWKF.DLL
deltmp
delnfr
czoo
restart

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\vbaliyi.exe');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\jsrasrc.exe');
 DeleteFile('c:\docume~1\admin\locals~1\temp\jsrasrc.exe');
 DeleteFile('c:\docume~1\admin\locals~1\temp\vbaliyi.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\051FEE.exe');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\IK1979qEPX0.exe');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\X9FEYdxMLz0.exe');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\fubOvHzaEU4.exe');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\tB3ztMwO91I.exe');
 DeleteFile('c:\program files\mail.ru\guard\guardmailru.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(21);
BC_Activate;
RebootWindows(true);
end.