F2 - REG:system.ini: UserInit=C:\WINDOWS.0\system32\userinit.exe , "C:\WINDOWS.0\M46840\Ja512486bLay.com"
O20 - Winlogon Notify: Csrss - csrss5.dll (file missing)

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\documents and settings\all users.windows.0\application data\kwinzysrch\kwinzy127.exe');
 TerminateProcessByName('c:\program files\kwinzysrch\kwinzy.exe');
 DeleteService('KwinzySrch Service');
 DeleteService('aoqct57f');
 DeleteFile('c:\program files\kwinzysrch\kwinzy.exe');
 DeleteFile('c:\documents and settings\all users.windows.0\application data\kwinzysrch\kwinzy127.exe');
 DeleteFile('C:\Program Files\KwinzySrch\kwinzy.dll');
 DeleteFile('C:\Program Files\KwinzySrch\kwinzy.exe');
 DeleteFile('C:\WINDOWS.0\System32\Drivers\aoqct57f.SYS');
 DeleteFile('C:\WINDOWS.0\M46840\Ja512486bLay.com');
 DeleteFile('C:\WINDOWS.0\sa-421844.exe');
 DeleteFile('C:\WINDOWS.0\system32\673843201528l.exe');
 DeleteFile('csrss5.dll');
 DeleteFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe');
 DelCLSID('{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}');
 ClearIECache;
 ClearQuarantine;
 DelAutorunByFileName('csrss5.dll');
 DelWinlogonNotifyByFileName('csrss5.dll');
ExecuteSysClean;
RebootWindows(true);
end.