begin
 ExecuteAVUpdate;
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
  then
   begin
    SearchRootkit(true, true);
    SetAVZGuardStatus(true);
   end;
 ClearQuarantine;
 QuarantineFile('C:\Users\Tema\appdata\roaming\searchindexer\moduleinno.exe','not-a-virus:RiskTool.Win32.BitCoinMiner.fqs');
 DeleteFile('C:\Users\Tema\appdata\roaming\searchindexer\moduleinno.exe','32');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 DeleteFileMask('C:\Users\Tema\appdata\roaming\searchindexer', '*', true, ' ');
 DeleteDirectory('C:\Users\Tema\appdata\roaming\searchindexer');          
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(false);
end.

;uVS v3.82.5 [http://dsrt.dyndns.org]
;Target OS: NTv5.1

OFFSGNSAVE
breg

............
............
clrmd
chklst
delvir

deltmp
delnfr
restart

;uVS v3.82.8 [http://dsrt.dyndns.org]
;Target OS: NTv5.1

OFFSGNSAVE
delall %SystemDrive%\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.URL
addsgn 1A166C9A5583528CF42B254E3143FE84C95AFEF6895B1F7AC4C3F679D9938DC5A6F73EA8C1DC1095D67F7B16D3CEB405825675A6A8254FA598A759D0388F9FBF 8 Win32/Kryptik.CFKQ [ESET-NOD32]

zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АЛСУ\LOCAL SETTINGS\TEMP\FSDGS.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АЛСУ\LOCAL SETTINGS\TEMP\ADOBE\READER_SL.EXE
addsgn 7300F79B556A1F275DE775E6ED94361DE2CED8E6E96B5F78B63503F874C251B33627B3173E3D9CC92B807B8AF66609FA2E20FD0E279AB04625D4BCC38506CA82 59 Win32/CoinMiner.RZ [ESET-NOD32]
delall C:\RECYCLER\MSCINET.EXE
delall %SystemDrive%\PROGRAM FILES\COMMON FILES\CREATIVEAUDIO\SPDWZNJXT.EXE
addsgn 1A7F119A5583C58CF42B831567C81271070914F2FDED9C9088B7C9F424D5428CE0AFC7533E555EF13984849F85AE4DF27DDF2BCA44DEB02CEEFC5B79908DD21B 8 Trojan:Win32/Neurevt.A

zoo %SystemDrive%\PROGRAM FILES\COMMON FILES\CREATIVEAUDIO\IFBXQLLFF.EXE
addsgn 1AC86F9A5583528CF42B254E3143FE84C9A2FFF68959FF54C7C34CB18CFA334CAA021B7B7C551454FFACC69FCF2399D63FDF614F99F6F22C4BFBB1D7EB442215 8 Win32/Neurevt.B [ESET-NOD32]

zoo %SystemDrive%\PROGRAM FILES\COMMON FILES\CREATIVEAUDIO\IJIUJSNJB.EXE
addsgn 1AAE129A5583528CF42B627DA804DEC9A5F0F2F3FCEB79F3189F3A43AF56BE4EA3F03DE401BE992F90BF97F9CF8B1705822031DF0B254FD3965BFF6EC7DFC7FA 8 Win32/Injector.BGYS [ESET-NOD32]

zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИН\APPLICATION DATA\10.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИН\APPLICATION DATA\16.EXE
zoo %SystemDrive%\DOCUMENTS AND SETTINGS\АДМИН\APPLICATION DATA\C731200

hide C:\PROGRAM FILES\WEBMONEY\WEBMONEY.EXE
hide %SystemDrive%\PROGRAM FILES\UBISOFT\UBISOFT GAME LAUNCHER\UNINSTALL.EXE
hide %SystemDrive%\PROGRAM FILES\ANVIR TASK MANAGER\ANVIR.EXE

;------------------------autoscript---------------------------

chklst
delvir

; McAfee Security Scan Plus
exec E:\Program Files\McAfee Security Scan\uninstall.exe

; Java(TM) 6 Update 22
exec MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022FF} /quiet

deltmp
delnfr
;-------------------------------------------------------------

czoo
restart