Universal Virus Sniffer v3.83 Copyright (c) Kuznetzoff Dmitriy 2009-14
Freeware

http://dsrt.dyndns.org

demkd@mail.ru

Donate:

WebMoney:
  R442182429613
  Z154203397744
  E378147978275

Paypal: 
  demkd@mail.ru

Bitcoin:
1KXExkYavLMXbkPpo7H3DUWTgskwMuK6rW

F.A.Q.

Q: uVS? What is it?
A: uVS is a powerful antivirus removal tool designed to ease the process of detecting and
   eliminating unknown 0-day viruses, rootkits, and bootkits.
   It's NOT designed to replace your antivirus!.
   
Q: Is it really simple?
A: It's really simple, but only for ADVANCED users with GREAT knowledge of Windows registry.
   If you are ORDINARY user than use it ONLY under helper's supervision.
   It is a VERY SHARP tool and you can accidentally kill your OS.

Q: What about compatibility?
A: Win2k, WinXP x86/x64, Win2k3 x86/x64, Vista x86/x64, Win7 x86/x64, Win8 x86/x64,
   (!) Windows PE 1.x 64Mb RAM.
       (without digital signature checking feature)
   (!) Windows PE 2.x-3.x 384mb RAM.
   (!) Windows PE 4.x 1024mb RAM.
       (with digital signature checking feature and with support the offline CatRoot)
   You can check offline Windows Seven x64 under Win2k, WinXP (!)x86 only(!), Vista x86/x64, WinPE,
   and vice-versa.

Q: Why Virus Base is empty?
A: uVS is a hunting tool, not antivirus! You can fill Virus Base by yourself if needed.

Q: Can I add signature to the Virus Base directly from malware file?
A: Yes. Use file's context menu or "Add signatures button".

Q: settings.ini
A:
   [Settings]
   ; Add filepath to the script on signature adding
   bAddComment  = 1 (1 default)

   ; Auto zoo
   bAutoZooOnDelAll = 1 (0 default)
 
   ; Block file execution on delall command
   bAutoBL = 1 (0 default)

   ; Auto add zoo command on malware detection (by F7)
   bAutoZooOnF7 = 1 (0 default)

   ; Auto add BL command
   bAutoBLOnF7 = 1 (0 default)

   ; 0 = don't create the log file.
   ; 1 = create log before CZOO command in Zoo.
   ; 2 = create log after script execution.
   ; 3 = create both logs.
   bSaveScrLog = 2 (2 default)

   ; Save description file on Zoo command
   bSaveZooFileInfo  = 1 (1 default)

   ; FORCE load all found users profiles in D&S directory.
   bAllProfiles  = 1 (0 default)
   
   ; Create BL.LOG
   bLogBL=1

   ; Network mode control.
   bNetFastLoad  = 0 (0 default, normal) 
                   1 (don't scan automatically, recommended)
                   2 (don't scan automatically and open remote desktop)

   ; Active mode control
   bFastLoad  = 0 (0 default, normal) 
                1 (don't scan automatically)

   ; Save window position on exit
   bSaveWndPos = 1 (0 default)

   ; Registry backup contol (not used in Win2k)
   bFastBackup = 1 (1 default, fast)

   ; Web thread control (16 maximum)
   MaxInetThreads = 4 (4 defualt)

   ; Compress OS Image
   ; 7-Zip/WinRAR required.
   bZipImage = 1 (1 default)
    
   ; Check list by criterion base
   ImgAutoAltF7 = 1 (1 by default, run check before ImgAutoF4)
                  2 (after ImgAutoF4)
                  0 (disbale)

   ; Auto Alt+F7 on OS Image load
   ImgAutoAltF7 = 1 (1 default)
   
   ; Auto F4 on OS Image load
   ImgAutoF4 = 1 (1 default)

   ; Name of Base of verified files
   Sha1Name (default SHA1)

   ; Auto create OS Image control
   bCreateImage  = 0 (0 default, don't create) 
                   1 (create and save)
                   2 (start minimized->create->save->exit)
                   3 (start minimized & muted->create->save->exit)

   ; Filter by developer (for VT/JT services only).
     vFilter (String)
     Sample: Kaspersky, DrWeb, AntiVir

   ; Autoname function for new virus in base.
     vGetName (String)
     Sample: Kaspersky, DrWeb, AntiVir

   ; Add all dirs in the list
     AddDirs
     Separator : |
     No recursion flag: >
     Sample: %sys32% | d:\tools | >%SystemDrive%

   ; Archive a file (OS Image)
     ArchiveFile = 7zip\7za.exe a -t7z -mx9 -m0=ppmd:o=32:mem=64m "%s.7z" "%s"
     (Sample for 7za.exe)

   ; Decompress OS Image
     DecompressImage = 7zip\7za.exe x -y "%s" -o"%s" *.txt

   ; Archive Zoo
     ArchiveZoo = 7zip\7za.exe a -t7z "%s.7z" -pvirus "%s\*.*"

   ; Archive OS image
     ArchiveFile = 7zip\7za.exe a -t7z -mx9 -m0=ppmd:o=32:mem=64m "%s.7z" "%s"

   ; Disable adding hashes of files to the base of verified files (for OS images only)
     ImgDisableAV (0 by default)

   ; Add "czoo" command automatically to the script if zoo command present
     bHlpCZoo (0 by default)

   ; Add "restart" command to the script automatically
     bHlpRestart (0 by default)

   ; Add /quiet key with misexec.exe for uninstall command in the script
     ImgUninstQuiet (0 by default)

   ; Add uninstall commands to the script for software detected by criterion (for OS images only)
     ImgAutoUninstall (0 by default)

   ; Unwind "delnfr" command to sequences of delref commands (for OS images only)
     ImgDelnfrUnwind (0 by default)

   ; Sript's name (w/o path) for adding to the end of the current AUTOscript.
   ; Unicode encoding only!
   ; Put your script to the "script" subfolder.
     ImgAutoScriptAdd 

   ; This flag used in autoscript function (Alt+A).
     ImgAutoDelMethod1 (1 by default)
     0 - ignore object with ?VIRUS? state.
     1 - use delall command on object with ?VIRUS? state.
     2 - use delref command.
     3 - use delref+del commands.

   ; This flag used in autoscript function (Alt+Shift+A).
     ImgAutoDelMethod2 (3 by default)
     0 - ignore object with ?VIRUS? state.
     1 - use delall command on object with ?VIRUS? state.
     2 - use delref command.
     3 - use delref+del commands.

   ; Sript's name (w/o path) for adding to the end of the current AUTOscript.
   ; Unicode encoding only!
   ; Put your script to the "script" subfolder.
     ImgAutoScriptAdd 

   ; Extensions filter for parsing function (Windows prefetcher).
     PrefetchExt (.EXE.SCR.DLL.SYS.BAT.CMD.VBS by default)

   ; For OS Image mode only. (Ctrl+T)
   ; Use #1,2,3,9 tweaks automatically if needed.
     ImgAutoTweak (0 by default)

   ; For OS Image mode only. (Ctrl+H)
     ImgAutoDelHost (0 by default)
      1 - delete detected records automatically.
      2 - use 14-th tweak automatically.

   ; Turn ON WDS support.
     bUseWDSList (by default 0)

   ; Extra extensions of files added by function File->Add to list->...
   ; Sample: .BAT.CMD.LNK.VBS
     Add2ListExt (by default empty string)

   ; TTL VT cache in days.
     vtCacheDays (by default 15)
      0 - disable cache
     -1 - unlimited cache

   ; Username for proxy server
     ProxyUser

   ; Password for proxy server
     ProxyPassword

   [APP]
   ; External file manager
   FM (for x86 OS)
   FM64 (for x64 OS)

   ; Browser.
   Browser

   ; Text editor.
   TextEditor (for x86 OS)
   TextEditor64 (for x64 OS)

How to kill trojans.
   (1) locate malware in the list (you can use F1, F4, F6 and special categories to help yourself)
   (2) Right click on file and select "Copy to Zoo" (if you needed sample of it)
   (3) Right click on file and select "Add the signature to the Virus Base"
   (4) Set name and length of the signature.
   (5) Go to (1) and repeat process with next malware.
   (6) Press "Check all List" button.
   (7) If you see any false detection go to Virus Base and correct signature's length.
   (8) Press "Kill all viruses" button.

Hotkeys.
   Esc         - Reset filter.
   Backspace   - Delete last letter.
   F1          - Hide/Show known and verified files.
   Ctrl+F1     - Hide/Show verified files.
   Alt+F1      - Hide/Show known files.
   F2          - Hide missed files and the files with not empty company name
   F3          - Load "Company name" and signatures.
   Ctrl+F3     - Enable auto load of "Company name". 
   F4          - Verify files by SHA1 Base
   F5          - Refresh.
   F6          - Check digital signatures. 
   F7          - Check the list by the Virus Base.
   F8          - Rise/Sink main Window.
   F9          - Hide all topmost windows and mark their owners.
   Shift+F10   - Context menu.
   Shift+Space - Mark object as verified.
   Shift+Del   - Delete all refs
   Ctrl+*      - Invert filter.
   Ctrl+Del    - Delete file only
   Ctrl+Shift+Del - Delete file and all refs
   Ctrl+H      - Delete all detected (by criterions) record in HOSTS.
   Ctrl+O      - Open OS Image
   Ctrl+P      - Scan mode Normal/Alternative
               (In Alternative mode you can see stealth processes)
   Ctrl+S      - Save the list.
   Ctrl+T      - Use #1,2,3,9,28,29 tweaks if needed.
   Ctrl+B      - Lock/Unlock Service Manager.
   Ctrl+U      - Uninstall all detected by criterion software. 
   Ctrl+Z      - Cancel last command (For OS Image mode only).
                 (or Alt+Backspace)
   Enter       - File information.
   Alt+Enter   - File properties.
   Del         - Delete from list.
   Alt+A       - Autoscript.
   Alt+Shift+A - Autoscript with registry virtualization.
   Alt+Del     - Cleanup (for all users) then delete all refs on missed objects
   Alt+Up      - Prev category.
   Alt+Down    - Next category.
   Alt+C       - Unlock/lock column's width adjustment.
   Alt+F       - Run external file manager with raised privileges.
   Alt+Shift+F - Run external file manager with raised privileges and open selected file's directory
   Alt+I       - Computer information
   Alt+L       - Log mode on/off.
   Alt+S       - Save the script.
   Alt+T       - Tweaks.
   Alt+U       - Open "Installed Applications" window
   Alt+V       - Remote desktop (network mode only)

   Ctrl+Shift+number -  Add a custom script to the current script.
                        Only UNICODE text files supported.
                        Filenames: 0.txt - 9.txt
                        Subdir: "script".
