begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\system32\icLEW.exe','');
 QuarantineFile('C:\WINDOWS\system32\ntmarta.dll','');
 QuarantineFile('c:\documents and settings\Владелец\application data\microsoft security essentials\msseces.exe','');
 TerminateProcessByName('c:\documents and settings\Владелец\application data\microsoft security essentials\msseces.exe');
 DeleteFile('c:\documents and settings\Владелец\application data\microsoft security essentials\msseces.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Security Essentials');
 DeleteFile('C:\WINDOWS\system32\icLEW.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(11);
ExecuteRepair(17);
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\windows\system32\qizhd.exe');
 DeleteFile('c:\windows\system32\qizhd.exe');
 DeleteFile('C:\Documents and Settings\Владелец\Мои документы\CompFile.exe');
DeleteFileMask('c:\documents and settings\Владелец\application data\microsoft security essentials', '*.*', true);
DeleteDirectory('c:\documents and settings\Владелец\application data\microsoft security essentials');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

F3 - REG:win.ini: load=C:\WINDOWS\system32\fWAHU.exe
O2 - BHO: MS Media Module - {17725630-A371-B5AB-3A9A-E3E013FEDFB0} - (no file)
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

gmer.exe -del service ayejrdhm
gmer.exe -del file "C:\WINDOWS\C:\WINDOWS\system32\qicnl.dll"
gmer.exe -del reg "HKLM\SYSTEM\CurrentControlSet\Services\ayejrdhm"
gmer.exe -del reg "HKLM\SYSTEM\ControlSet003\Services\ayejrdhm"
gmer.exe -reboot