R3 - URLSearchHook: (no name) -  - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\d3877ed4.exe,\\?\globalroot\systemroot\system32\6gLKD6S.exe,
O4 - HKLM\..\Run: [m32systemm] %SystemRoot%\m32systemm.exe
O9 - Extra button: (no name) - DctMapping - (no file)
O20 - Winlogon Notify: arm32reg - C:\Documents and Settings\All Users\Documents\Settings\arm32.dll (file missing)

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\windows\m32systemm.exe');
 QuarantineFile('C:\WINDOWS\system32\ws03res.dll','');
 QuarantineFile('C:\nkub\BSClnt_3\SYSTEM\cryptlib.dll','');
 QuarantineFile('C:\nkub\BSClnt_3.old\SYSTEM\cryptlib.dll','');
 QuarantineFile('C:\uralsib\old\BSClnt_3\EXE\cryptlib.dll','');
 QuarantineFile('C:\uralsib\old\BSClnt_3\SYSTEM\cryptlib.dll','');
 QuarantineFile('\\?\globalroot\systemroot\system32\6gLKD6S.exe','');
 QuarantineFile('C:\nkmb\ClientW\Obj\ClntW32.exe','');
 QuarantineFile('C:\WINDOWS\system32\trafinspag.exe','');
 QuarantineFile('C:\WINDOWS\system32\d3877ed4.exe','');
 QuarantineFile('C:\Documents and Settings\All Users\Documents\Settings\arm32.dll','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\pan_mdm.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\pan_mdfl.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\pan_emmi.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\pan_bus.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\grdkey.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\dot4usb.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys','');
 QuarantineFile('C:\Program Files\InfoTeCS\ViPNet CryptoService\itccspini.exe','');
 QuarantineFile('C:\PVSW\BIN\NTBTRV.EXE','');
 QuarantineFile('C:\PVSW\BIN\W3SQLMGR.EXE','');
 QuarantineFile('C:\Program Files\InfoTeCS\ViPNet CryptoService\ivpsrv.exe','');
 QuarantineFile('C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe','');
 QuarantineFile('c:\windows\m32systemm.exe','');
 DeleteFile('c:\windows\m32systemm.exe');
 DeleteFile('C:\Documents and Settings\All Users\Documents\Settings\arm32.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg','DLLName');
 DeleteFile('C:\WINDOWS\system32\d3877ed4.exe');
 DeleteFile('\\?\globalroot\systemroot\system32\6gLKD6S.exe');
 DelBHO('{32683183-48a0-441b-a342-7c2a440a9478}');
 DelBHO('{DFDC8970-FD66-4385-B8C0-835A4AA1DA00}');
 DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
 DelBHO('{71F65890-5ED6-11d4-9665-00E02962D81A}');
 DelBHO('{17FA5CD6-5737-45c2-B194-74C8A4A7F7E7}');
 DelBHO('DctMapping');
DelWinlogonNotifyByFileName('arm32reg');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
AutoFixSPI;
ExecuteWizard('TSW', 2, 2, true);
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.