begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('c:\program files\internet explorer\wmpscfgs.exe','');
 QuarantineFile('C:\program files\quicktime\qttask    .exe','');
 QuarantineFile('C:\WINDOWS\system32\sshnas21.dll','');
 QuarantineFile('C:\WINDOWS\system32\koodoru.exe','');
 QuarantineFile('C:\Program Files\Internet Explorer\iexplore.exe','');
 QuarantineFile('C:\Documents and Settings\Anna\Application Data\wyzlo.exe','');
 QuarantineFile('c:\docume~1\anna\locals~1\temp\vwj7.tmp','');
 TerminateProcessByName('c:\docume~1\anna\locals~1\temp\vwj7.tmp');
 QuarantineFile('c:\windows\system32\lyquynnoo.exe','');
 TerminateProcessByName('c:\windows\system32\lyquynnoo.exe');
 DeleteFile('c:\windows\system32\lyquynnoo.exe');
 DeleteFile('c:\docume~1\anna\locals~1\temp\vwj7.tmp');
 DeleteFile('C:\Documents and Settings\Anna\Application Data\wyzlo.exe');
 DeleteFile('C:\WINDOWS\system32\koodoru.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','dipa');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunServices','dipa');
 DeleteFile('C:\WINDOWS\system32\sshnas21.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\SSHNAS\Parameters','ServiceDll');
 DeleteFile('c:\program files\internet explorer\wmpscfgs.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Adobe_Reader');
DeleteFileMask('C:\WINDOWS\Tasks','At*.job', false);
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(17);
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('ieoz2agaxog0r2ia');
 TerminateProcessByName('c:\program files\quicktime\qttask      .exe');
 DeleteFile('c:\program files\quicktime\qttask      .exe');
 DeleteFile('C:\WINDOWS\system32\sazoodoul.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE',' Software\Microsoft\Windows NT\CurrentVersion\Winlogon',' Taskman');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','QuickTime Task');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\program files\internet explorer\wmpscfgs.exe');
 DeleteFile('c:\program files\internet explorer\wmpscfgs.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Adobe_Reader');
 DeleteFile('realsched .exe');
 DeleteFile('avp .exe');
 DeleteFile('ICQ Service.exe');
 DeleteFile('wmpscfgs.exe');
 DeleteFileMask('C:\WINDOWS\Tasks','At*.job', false);
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.