F3 - REG:win.ini: run=C:\WINDOWS\system32\equsxrt.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\riU1TEg.exe,
O4 - Startup: monmzb32.exe
O20 - AppInit_DLLs: C:\WINDOWS\TEMP\cmj.dll

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\Documents and Settings\User\Главное меню\Программы\Автозагрузка\monmzb32.exe','');
 DeleteFile('C:\Documents and Settings\User\Главное меню\Программы\Автозагрузка\monmzb32.exe');
 DeleteFile('C:\WINDOWS\TEMP\cmj.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.