begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFileMask('%Temp%', '*.*', true);
TerminateProcessByName('d:\windows\system32\qtplugin.exe');
TerminateProcessByName('d:\windows\system32\wmicvrt.exe');
DeleteFile('d:\windows\system32\qtplugin.exe');
DeleteFile('d:\windows\system32\wmicvrt.exe');
DeleteFile('d:\windows\system32\svchost.exe:exe.exe:$data');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','RegistryMonitor1');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(6);
ExecuteRepair(8);
ExecuteRepair(9);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
ClearHostsFile;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('D:\System Volume Information\_restore{4C75BD27-55C8-425B-AE35-E2D40C2B5383}\RP219\A0074989.exe:exe.exe:$DATA');
DeleteFile('C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe');
DeleteFile('D:\DOCUME~1\7631~1\LOCALS~1\Temp\tmp1298.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Internet Connection Wizard Setup Tool');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','AutoStart');
DeleteFileMask('D:\Documents and Settings\Вероника\Local Settings\Temp' , '*.*', true);
DeleteFileMask('D:\Documents and Settings\Слава\Local Settings\Temp' , '*.*', true);
DeleteFileMask('D:\Documents and Settings\Вероника\Local Settings\Temporary Internet Files' , '*.*', true);
DeleteFileMask('%Temp%', '*.*', true);
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

R3 - URLSearchHook: (no name) -  - (no file)
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - D:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - D:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKCU\..\Run: [MSConfig] D:\Documents and Settings\Слава\baao.exe \u

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 DeleteFile('D:\DOCUME~1\7631~1\LOCALS~1\Temp\tmp1298.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','AutoStart');
 DeleteFile('D:\Documents and Settings\NetworkService\uqde.exe');
 DeleteFile('D:\Documents and Settings\Слава\baao.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','MSConfig');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','MSConfig');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MSConfig');
 DeleteFile('D:\Program Files\AskBarDis\bar\bin\askBar.dll');
 DeleteFile('D:\System Volume Information\_restore{4C75BD27-55C8-425B-AE35-E2D40C2B5383}\RP219\A0074989.exe:exe.exe:$DATA');
 DeleteDirectory('C:\Program Files\Ask.com ');
 DelBHO('{3041d03e-fd4b-44e0-b742-2d9b88305f98}');
 DelBHO('{201f27d4-3704-41d6-89c1-aa35e39143ed}');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.