begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('c:\windows\system32\dwwinsrv.exe');
DeleteFile('c:\windows\system32\verclsidsrv.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\winde32.exe');
DelCLSID('{28ABC5C0-4FCB-11CF-AAX5-81CX1C735612}');
ExecuteSysClean;
RebootWindows(true);
end.

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 DeleteFile('C:\Program Files\plugin.exe');
 DeleteFile('C:\DOCUME~1\Keeper\APPLIC~1\FieryAds\FieryAds.dll');
 DeleteFile('C:\Windows\Tasks\At1.job');
 DeleteFile('C:\Windows\Tasks\At2.job');
 DeleteFile('C:\Windows\Tasks\At3.job');
 DeleteFile('C:\Windows\Tasks\At4.job');
 DeleteFile('C:\Windows\Tasks\At5.job');
 DeleteFile('C:\Windows\Tasks\At6.job');
 DeleteFile('C:\Windows\Tasks\At7.job');
 DeleteFile('C:\Windows\Tasks\At8.job');
 DeleteFile('C:\WINDOWS\system32\shlwapi.exe');
 DeleteFile('C:\WINDOWS\system32\system.exe');
 DelBHO('{6D125299-C2A9-4DBC-BEC3-6F7124E39A41}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SYS1');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','plugin');
 DeleteFileMask('%AppData%\CMedia', '*.*', true);
 DeleteFileMask('%AppData%\FieryAds', '*.*', true);  
 DeleteDirectory('%AppData%\CMedia'); 
 DeleteDirectory('%AppData%\FieryAds'); 
 RegKeyDel('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CMedia');
 RegKeyDel('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FieryAds');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteRepair(6 );
 ExecuteRepair(8 );
 ExecuteRepair(16 );
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
 RebootWindows(true);
end.

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 DeleteFile('C:\Program Files\plugin.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','plugin');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

    
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - (no file)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O9 - Extra button: Отправить SMS - {9787C789-65F9-4291-A2DE-BE288D933EE3} - http://ipsms.ru/smsfromie.html (file missing)

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 DeleteFile('C:\Documents and Settings\user\Application Data\CMedia\CMedia.dll');
 DeleteFile('http:\ipsms.ru/smsfromie.html');
 DelBHO('{9787C789-65F9-4291-A2DE-BE288D933EE3}');     
 DelCLSID('{6B830884-20E3-4AB6-B672-2629F0F72071}');     
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteRepair(1 );
 ExecuteRepair(13 );        
 RebootWindows(true);
end.

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('c:\users\6eed~1\appdata\local\temp\kui2bb1.tmp');
 DeleteFile('c:\users\6eed~1\appdata\local\temp\kui2bb1.tmp');
 DeleteFile('C:\Users\6EED~1\AppData\Local\Temp\fjhxm.dll');
 DeleteFile('C:\Users\6EED~1\AppData\Local\Temp\kui2BB1.tmp');
 DeleteFile('C:\Windows\System32\XP-D41D8CD9.EXE');
 DeleteFile('C:\SysFiles\ae_aGfqCIUFp5X.dll');
 DeleteFile('C:\SysFiles\antDGV40eY.dll');
 DeleteFile('C:\SysFiles\aQi3B7.dll');
 DeleteFile('C:\Users\Павел\AppData\Roaming\msmedia.dll');
 DeleteFile('C:\Users\Павел\Application Data\msmedia.dll');
 DeleteFile('C:\SysFiles\aVi8_9iEo.dll');
 DelBHO('{A33D560A-B0BD-7F58-D9A0-40E28DBD2FF7}');
 DelBHO('{9D64F819-9380-8473-DAB2-702FCB3D7A3E}');
 DelBHO('{8F68DC93-6E4D-4090-8F40-BA3D6592F493}');
 DelBHO('{88888888-8888-8888-8888-888888888888}');
 DelBHO('{82674476-E3A9-DD07-1166-6367D19B7152}');
 DelBHO('{2B9A30E1-FF31-D80E-A0DB-C73509D9C763}');
 DelBHO('{1FA052CF-9A76-71AA-F743-B6FEBAF510CF}');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteRepair(11 );
 RebootWindows(true);
end.