F3 - REG:win.ini: run=C:\WINDOWS\system32\portmap.exe
O4 - HKLM\..\Run: [Windows System Guard] C:\Documents and Settings\Администратор\Application Data\dlll.exe
O4 - HKLM\..\RunOnce: [*Restore] C:\WINDOWS\system32\restore\rstrui.exe -c
O4 - HKCU\..\Run: [gotnewupdate005.exe] C:\Documents and Settings\Администратор\Application Data\A1BA21EE21A6D8A1FDCE158989E33B1B\gotnewupdate005.exe
O4 - HKCU\..\Run: [CaKaZuMoMkaDVa] C:\fish\ville\nao4ja.exe
O4 - Startup: Quick Office.lnk = C:\WINDOWS\system32\portmap.exe

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('c:\documents and settings\Администратор\gr3at.exe');
 TerminateProcessByName('c:\documents and settings\Администратор\application data\a1ba21ee21a6d8a1fdce158989e33b1b\gotnewupdate005.exe');
 DeleteFile('{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job');
 DeleteFile('{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job');
 DelCLSID('7MPEKAD-841A3-3MAJ5-Z2LGK-MWL3Y');
 DeleteFile('C:\Documents and Settings\Администратор\Главное меню\Программы\Автозагрузка\Quick Office.lnk');
 DeleteFile('c:\documents and settings\Администратор\application data\a1ba21ee21a6d8a1fdce158989e33b1b\gotnewupdate005.exe');
 DeleteFile('c:\documents and settings\Администратор\gr3at.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\A1BA21EE21A6D8A1FDCE158989E33B1B\gotnewupdate005.exe');
 DeleteFile('C:\Documents and Settings\Администратор\gr3at.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','gotnewupdate005.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\dlll.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Windows System Guard');
 DeleteFile('C:\WINDOWS\system32\portmap.exe');
 DeleteFile('C:\fish\ville\nao4ja.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CaKaZuMoMkaDVa');
 DeleteFile('C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\L24RLTB8\1005pskds[1].exe');
 DeleteFile('C:\Documents and Settings\Администратор\bog56.exe');
 DeleteFile('C:\Documents and Settings\Администратор\DoctorWeb\Quarantine\pfx963.tmp.exe');
 DeleteFile('C:\Documents and Settings\Администратор\fafa56.exe');
 DeleteFile('C:\Documents and Settings\Администратор\jsajweahfsq.exe');
 DeleteFile('C:\Documents and Settings\Администратор\msylisu.exe');
 DeleteFile('C:\Documents and Settings\Администратор\sdak3a.exe');
 DeleteFile('C:\System Volume Information\_restore{E6FA7E08-231F-4D68-95CE-A568ADE615DE}\RP382\A0444168.exe');
 DeleteFile('C:\System Volume Information\_restore{E6FA7E08-231F-4D68-95CE-A568ADE615DE}\RP382\A0444221.exe');
 DeleteFile('C:\System Volume Information\_restore{E6FA7E08-231F-4D68-95CE-A568ADE615DE}\RP384\A0444278.exe');
 DeleteFile('C:\System Volume Information\_restore{E6FA7E08-231F-4D68-95CE-A568ADE615DE}\RP389\A0447957.exe');
 DeleteFile('C:\System Volume Information\_restore{E6FA7E08-231F-4D68-95CE-A568ADE615DE}\RP414\A0482363.exe');
 BC_ImportALL;
 ExecuteSysClean;
 BC_Activate;
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
 RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\Kgumaa.exe','');
 QuarantineFile('c:\TEMP\Kn2.exe','');
 DelBHO('{61012D92-4CCC-419C-8B4B-C271819B41DC}');
DeleteFile('C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job');
DeleteFile('C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job');
 DeleteFile('C:\WINDOWS\system32\appmgmt.dll');
 DeleteFile('c:\TEMP\Kn2.exe');
 DeleteFile('C:\WINDOWS\Kgumaa.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.