begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\autorun.inf','');
 QuarantineFile('C:\WINDOWS\system32\netprotocol.dll','');
 QuarantineFile('\\?\globalroot\systemroot\system32\vKRpeGL.exe','');
 DeleteService('Netprotocol');
 StopService('Netprotocol');
 QuarantineFile('c:\documents and settings\user\application data\netprotocol.exe','');
 TerminateProcessByName('c:\documents and settings\user\application data\netprotocol.exe');
 DeleteFile('c:\documents and settings\user\application data\netprotocol.exe');
 DeleteFile('\\?\globalroot\systemroot\system32\vKRpeGL.exe');
 DeleteFile('C:\WINDOWS\system32\netprotocol.dll');
 DeleteFile('C:\autorun.inf');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(13);
ExecuteRepair(16);
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.

R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - (no file)
R3 - URLSearchHook: (no name) - {468CD8A9-7C25-45FA-969E-3D925C689DC4} - (no file)
R3 - URLSearchHook: (no name) -  - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\0lpRQzI.exe,\\?\globalroot\systemroot\system32\IM7C3jb.exe,\\?\globalroot\systemroot\system32\vKRpeGL.exe,

begin
RegKeyStrParamWrite('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Userinit','C:\WINDOWS\system32\userinit.exe,');
RebootWindows(true);
end.