R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Ссылки
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - (no file)
R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSsystem322fd84a32.exe,\?g lobalrootsystemrootsystem32iDnumcs.exe,

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\esp3A28.tmp','');
QuarantineFile('C:\WINDOWS\system32\2fd84a32.exe','');
DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\esp3A28.tmp');
DeleteFile('C:\WINDOWS\system32\2fd84a32.exe');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(20);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

begin
RegSearch('HKLM', '', 'esp3A28.tmp');
SaveLog(GetAVZDirectory + 'avz.log');
end.

begin
 RegKeyDel('HKEY_LOCAL_MACHINE','SYSTEM\ControlSet001\Control\Print\Providers\663B2385');
 RegKeyDel('HKEY_LOCAL_MACHINE','SYSTEM\ControlSet\Control\Print\Providers\663B2385');
 RegKeyDel('HKEY_LOCAL_MACHINE','SYSTEM\ControlSet002\Control\Print\Providers\663B2385');
RegKeyDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes');
RegKeyCreate('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes');
 RebootWindows(true);
end.

Зараженные параметры в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_1 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_2 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_3 (Rootkit.Agent) -> No action taken.

D:\System Volume Information\_restore{051B9998-C6EA-4176-A9EB-1231B255D5D2}\RP95\A0057406.exe (Malware.Packer.Morphine) -> No action taken.
D:\System Volume Information\_restore{051B9998-C6EA-4176-A9EB-1231B255D5D2}\RP95\A0057511.exe (Malware.NSPack) -> No action taken.
E:\System Volume Information\_restore{051B9998-C6EA-4176-A9EB-1231B255D5D2}\RP94\A0055762.exe (Adware.TMAagent) -> No action taken.
E:\System Volume Information\_restore{051B9998-C6EA-4176-A9EB-1231B255D5D2}\RP95\A0057638.exe (Adware.TMAagent) -> No action taken.
C:\Program Files\Common Files\keylog.txt (Malware.Trace) -> No action taken.