var j:integer; NumStr:string;
begin
for j:=0 to 999 do
begin
if j=0 then
NumStr:='CurrentControlSet' else 
if j<10 then
NumStr:='ControlSet00'+IntToStr(j) else
if j<100 then
NumStr:='ControlSet0'+IntToStr(j) else
NumStr:='ControlSet'+IntToStr(j);
if RegKeyExistsEx('HKLM', 'SYSTEM\'+NumStr+'\Services\ruacqrksf') then
begin
RegKeyResetSecurity('HKLM', 'SYSTEM\'+NumStr+'\Services\ruacqrksf');
RegKeyDel('HKLM','SYSTEM\'+NumStr+'\Services\ruacqrksf');
AddToLog('ключ в разделе реестра HKLM\SYSTEM\'+NumStr+'\Services\ruacqrksf удален.');
end;
end;
DeleteService('ruacqrksf'); 
DeleteFile('C:\WINDOWS\system32\pxeqog.dll');
DeleteFile('c:\documents and settings\all users\systems.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Shell');
DeleteFile('globalroot\systemroot\system32\userinit.exe');
DeleteFileMask('C:\Documents and Settings\Admin\Local Settings\Temp', '*.*', true);
DeleteFileMask('C:\old\Documents and Settings\Maks\Local Settings\Temporary Internet Files\Content.IE5', '*.*', true);
DeleteFileMask('C:\old\Documents and Settings\Саня\Local Settings\Temp', '*.*', true);
DeleteFileMask('C:\old\Documents and Settings\Татьяна\Local Settings\Temporary Internet Files\Content.IE5', '*.*', true);
SaveLog(GetAVZDirectory + 'rua.log');
ExecuteSysClean;
RebootWindows(true);
end.

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\ruacqrksf');
RegKeyResetSecurity('HKLM','SYSTEM\ControlSet002\Services\ruacqrksf');
RegKeyDel('HKLM','SYSTEM\CurrentControlSet\Services\ruacqrksf');
RegKeyDel('HKLM','SYSTEM\ControlSet002\Services\ruacqrksf');
DeleteService('ruacqrksf'); 
DeleteFile('C:\WINDOWS\system32\pxeqog.dll'); 
ExecuteSysClean;
RebootWindows(true);
end.

 
F2 - REG:system.ini: UserInit=\\.\globalroot\systemroot\system32\userinit.exe,