begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('C:\system32\system.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','system');
DeleteFile('c:\RECYCLER\k-1-3542-4232123213-7676767-8888886\root.exe');
DeleteFile('C:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\setup.exe');
DeleteFile('C:\GAMES.EXE');
DeleteFile('C:\RECYCLER\S-1-5-21-1547161642-1326574676-682003330-1003\Dc322.EXE');
DeleteFile('C:\System Volume Information\_restore{6930C412-1A87-42C9-A507-B048E11DC278}\RP182\A0036235.EXE');
DeleteFile('C:\System Volume Information\_restore{6930C412-1A87-42C9-A507-B048E11DC278}\RP182\A0036263.EXE');
DeleteFile('C:\System Volume Information\_restore{6930C412-1A87-42C9-A507-B048E11DC278}\RP182\A0036277.exe');
DeleteFile('C:\System Volume Information\_restore{6930C412-1A87-42C9-A507-B048E11DC278}\RP183\A0036329.EXE');
DelCLSID('{23KLN5J0-4OPM-11WE-AAX5-24EF1F387232}');
DelCLSID('{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}');
ExecuteSysClean;
RebootWindows(true);
end.

 
R3 - URLSearchHook: (no name) -  - (no file)
F2 - REG:system.ini: Shell=explorer.exe rundll32.exe bfwl.pgo jagktms
F2 - REG:system.ini: UserInit=E:\WINDOWS\system32\userinit.exe,E:\WINDOWS\system32\sdra64.exe,

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('E:\Program Files\plugin.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','plugin');
 DeleteFile('E:\WINDOWS\system32\sdra64.exe');
 DeleteFile('E:\DOCUME~1\Admin\LOCALS~1\Temp\utfw.exe');
 DeleteFile('E:\Windows\Tasks\SysteCheck.job');
 DeleteFile('bfwl.pgo');
ExecuteSysClean;
 ExecuteRepair(16);
RebootWindows(true);
end.