R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSsystem32sdra64.exe,\?glo balrootsystemrootsystem32XpWMBb7.exe,\?globalrootsystemrootsystem32RJ5vH QJ.exe,
O4 - HKCU\..\Run: [Shell] C:\Documents and Settings\All Users\systems.exe

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('C:\Documents and Settings\All Users\systems.exe');
TerminateProcessByName('ф‘| ±—|К‘|фz');
StopService('abp470n5');
QuarantineFile('abp470n5.sys','');
QuarantineFile('ф‘| ±—|К‘|фz','');
QuarantineFile('C:\Documents and Settings\All Users\systems.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033\netsrv.exe','');
QuarantineFile('C:\WINDOWS\system32\sdra64.exe','');
QuarantineFile('\\?\globalroot\systemroot\system32\RJ5vHQJ.exe','');
QuarantineFile('\\?\globalroot\systemroot\system32\XpWMBb7.exe','');
DeleteFile('abp470n5.sys');
DeleteFile('ф‘| ±—|К‘|фz');
DeleteFile('C:\Documents and Settings\All Users\systems.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1033\netsrv.exe');
DeleteFile('C:\WINDOWS\system32\sdra64.exe');
DeleteFile('\\?\globalroot\systemroot\system32\RJ5vHQJ.exe');
DeleteFile('\\?\globalroot\systemroot\system32\XpWMBb7.exe');
DelCLSID('28ABC5C0-4FCB-11CF-AAX5-81CX1C635612');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Shell');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Generic Host for Win32 Services');
DeleteService('abp470n5');
DeleteFileMask('C:\Documents and Settings\Admin\Local Settings\Temp', '*.*', true);
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(6);
ExecuteRepair(8);
ExecuteRepair(20);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.