R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: MadLen.uCoz.coM Toolbar - {8dec4b69-27c4-405d-a37d-8d45c83f66ab} - C:\Program Files\MadLen.uCoz.coM\tbMadL.dll
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe srnh.lto iqfnr
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\Q7rvn16.exe,\\?\globalroot\systemroot\

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\WINDOWS\system32\759d6be.exe');
 DeleteFile('\\?\globalroot\systemroot\system32\CZz3nDa.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run','Windows Image Viewer Service');
 DeleteFile('imageviewer.exe');
ExecuteSysClean;
 ExecuteRepair(20);
RebootWindows(true);
end.

 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\Q7rvn16.exe,\\?\gl
O4 - S-1-5-18 Startup: winwyo32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: winwyo32.exe (User 'Default user')
O4 - Startup: winwyo32.exe

 
var
Lines : TStrings;
i : integer;
begin
Lines := TStringList.Create;
SearchFiles('%system32%', '*.exe', Lines, true, false);
for i:= 0 to Lines.Count-1 do
AddToLog(Lines[i]+', Size='+inttostr(GetFileSize(Lines[i])));
Lines.Free;
DeleteFile('C:\Documents and Settings\Рома\Главное меню\Программы\Автозагрузка\winwyo32.exe');
DeleteFile('\\?\globalroot\systemroot\system32\HQuV7Ru.exe');
DeleteFile('\\?\globalroot\systemroot\system32\Q7rvn16.exe');
ExecuteSysClean;
SaveLog(GetAVZDirectory + 'files.log');
RebootWindows(true);
end.

 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\Q7rvn16.exe,\\?\globalroot\systemroot\system3

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\WINDOWS\system32\8OGZwbQ.exe');
 DeleteFile('C:\WINDOWS\system32\OiW3bYu.exe');
ExecuteSysClean;
RebootWindows(true);
end.