R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.myheritage.com
O4 - HKUS\S-1-5-19\..\RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,OnceFirstLogonInstall,0 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,OnceFirstLogonInstall,0 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'Default user')
O9 - Extra button: Microsoft Knowledge Base - {8B2D996F-B7D1-4961-A929-414D9CF5BA7B} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra 'Tools' menuitem: Microsoft Knowledge Base - {8B2D996F-B7D1-4961-A929-414D9CF5BA7B} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 DeleteFile('http:\support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO');
 DelBHO('{8B2D996F-B7D1-4961-A929-414D9CF5BA7B}');
 DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
 RebootWindows(true);
end.

R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe
O4 - HKLM\..\Run: [Microsoft(R) System Manager] D:\WINDOWS\system32\fac7d7.exe
O4 - HKLM\..\RunServices: [csrcs] D:\WINDOWS\system32\csrcs.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] D:\WINDOWS\system32\csrcs.exe
O9 - Extra button: ICQ Lite - {E59EB121-F339-4851-A3BA-FE49C35617C2} - ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {E59EB121-F339-4851-A3BA-FE49C35617C2} - ICQ.exe (file missing)

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('d:\windows\system32\fac7d7.exe');
 TerminateProcessByName('d:\windows\system32\csrcs.exe');
 DeleteFile('d:\windows\system32\csrcs.exe');
 DeleteFile('d:\windows\system32\fac7d7.exe');
 DeleteFile('D:\WINDOWS\system32\csrcs.exe');
 DeleteFile('D:\WINDOWS\system32\fac7d7.exe');
 DeleteFile('Explorer.exe csrcs.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','csrcs');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft(R) System Manager');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteRepair(6);
 ExecuteRepair(16 );  
 RebootWindows(true);
end.