O9 - Extra button: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: InterCasino $$$ - {909AAEB6-C2CB-4AB5-A7BB-C33B72AB4BFB} - http://www.intercasino.com (file missing) (HKCU)

 
begin
SetAVZPMStatus(True);
SetAVZGuardStatus(True);
 StopService('upperdev');
 DeleteFile('c:\docume~1\АЛЕКСА~1\locals~1\temp\rarsfx0\6cfb8a.exe');
 DeleteFile('C:\DOCUME~1\АЛЕКСА~1\LOCALS~1\Temp\jmqcfx.dll');
 DeleteFile('C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys');
 DeleteFile('C:\WINDOWS\Temp\TPDIR\setup.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','PowerDirector');
 DeleteFile('C:\WINDOWS\system32\XP-326E380A.EXE');
 DeleteFile('C:\DOCUME~1\АЛЕКСА~1\LOCALS~1\Temp\ccwhmi.exe');
 DeleteFile('C:\windows\tasks\WindowsCheck.job');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 
begin
SetAVZGuardStatus(True);
DeleteFile('C:\Users\07C4~1\AppData\Local\Temp\clfhlpc.dll');
DeleteFileMask('%Temp%', '*.*', true);
ExecuteSysClean;
RebootWindows(true);
end.

 
begin
SetAVZGuardStatus(True);
DelBHO('{71E59D37-D7FC-4ED6-BC1D-D13BE02FE6C5}');
DelBHO('{FFFFE708-B832-42F1-BAFF-247753B5E452}');
DeleteFile('C:\Users\E48C~1\AppData\Local\Temp\valhz.dll');
DeleteFile('C:\Windows\system32\megaru.dll');
ExecuteSysClean;
RebootWindows(true);
end.

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('zoldwq');
DeleteService('yvlalxkw');
DeleteService('yurghwlhb');
DeleteService('xsumqpkt');
DeleteService('xorovroi');
DeleteService('whgjbp');
DeleteService('ukuokbt');
DeleteService('uctdsjin');
DeleteService('svtoin');
DeleteService('scmidlq');
DeleteService('qzyejnbhh');
DeleteService('qjswilsf');
DeleteService('owzbmzfsl');
DeleteService('outcwbn');
DeleteService('lbypru');
DeleteService('kucvtfg');
DeleteService('jxafal');
DeleteService('jhcnsb');
DeleteService('hsaceci');
DeleteService('hmwqt');
DeleteService('hdlgfw');
DeleteService('ggcejzcwt');
DeleteService('gdelmxg');
DeleteService('ffxctzzo');
DeleteService('fahmujbvd');
DeleteService('ewyjpp');
DeleteService('eoqfubkpp');
DeleteService('bzjgctgg');
DeleteService('bvyycbi');
DeleteService('aviyb');
DeleteService('arxfpla');
StopService('arxfpla');
DeleteFile('C:\WINDOWS\system32\02.tmp');
DeleteFile('C:\autorun.wsh');
DeleteFile('D:\autorun.wsh');
ExecuteSysClean;
RebootWindows(true);
end.