F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,c:\windows\system32\sdra64.exe,\\?\globalroot\systemroot\system32\pdb4v4h.exe,
O4 - HKLM\..\Run: [plugin] "C:\Program Files\plugin.exe"
O4 - HKLM\..\Run: [Generic Host for Win32 Services] ф‘|xЋ
O20 - Winlogon Notify: mute32 - mute32.dll (file missing)

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
RenameFile('C:\WINDOWS\System32\sfcfiles.dll', 'C:\WINDOWS\System32\sfcfiles.bak');
CopyFile('C:\WINDOWS\System32\dllcache\sfcfiles.dll','C:\WINDOWS\System32\sfcfiles.dll');
 BC_DeleteFile('C:\WINDOWS\System32\sfcfiles.bak');
 DeleteService('WINIO');
 DeleteService('catchme');
 BC_DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\catchme.sys');
 BC_DeleteFile('\\?\globalroot\systemroot\system32\pdb4v4h.exe');
 BC_DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.797\winio.sys');
 BC_DeleteFile('c:\windows\system32\sdra64.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Generic Host for Win32 Services');
 BC_DeleteFile('C:\Program Files\plugin.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','plugin');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(16);
ExecuteRepair(20);
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 BC_DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.797\winio.sys');
 BC_DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\catchme.sys');
BC_DeleteSvc('cd20xrnt');
BC_DeleteSvc('WINIO');
BC_Activate;
ExecuteSysClean;
RebootWindows(true);
end.