begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DelBHO('{CF272101-7F6E-4CF2-9453-B4C5D2FC32C0}');
DeleteFile('D:\WINDOWS\System32\netprotocol.dll');
DeleteFile('D:\WINDOWS\System32\netprotocol.exe');
DeleteFile('C:\Documents and Settings\All Users\systems.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Shell');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Netprotocol');
DeleteFile('\\?\globalroot\systemroot\system32\I3p4ZUw.exe');
DeleteFile('\\?\globalroot\systemroot\system32\euYDcpW.exe');
DeleteFile('%AppData%\FieryAds\FieryAds.dll');
DeleteFile('%AppData%\FieryAds\FieryAdsUninstall.exe');
RegKeyDel('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FieryAds');
DeleteFile('D:\WINDOWS\system32\KB905474\wgasetup.exe');
DeleteFile('D:\WINDOWS\Tasks\WGASetup.job');
ExecuteSysClean;
ExecuteRepair(12);
ExecuteRepair(13);
ExecuteRepair(16);
RebootWindows(true);
end.

R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: (no name) - {63432924-FF0F-4F2D-BA15-FE46454977A3} - (no file)
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\I3p4ZUw.exe,\\?\globalroot\systemroot\system32\euYDcpW.exe,
O20 - AppInit_DLLs: D:\WINDOWS\system32\tb.dll

begin
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('D:\WINDOWS\system32\tb.dll');
 DeleteFile('D:\WINDOWS\system32\netprotdrvss');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.