begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('c:\windows\system32\userini.exe');
DeleteFile('C:\Documents and Settings\Администратор\Application Data\lwtwfl.exe');
DeleteFile('C:\Documents and Settings\Администратор\ctfmon.exe,C:\RECYCLER\S-1-5-21-6665641070-0373855446-800768346-9459\yv8g67.exe,C:\Documents and Settings\Администратор\Application Data\vgdoqo.exe,explorer.exe,C:\Documents and Settings\Администратор\Application Data\lwtwfl.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
DeleteFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe');
DeleteFile('C:\WINDOWS\system32\svchost.exe:exe.exe:$DATA');
DeleteFile('C:\WINDOWS\explorer.exe:userini.exe:$DATA');
DeleteFile('C:\System Volume Information\_restore{8A8C6256-7D2C-48D9-A0B3-EC4FB00DB447}\RP469\A0107732.exe:exe.exe:$DATA');
DeleteFile('C:\System Volume Information\_restore{8A8C6256-7D2C-48D9-A0B3-EC4FB00DB447}\RP466\A0107575.exe:exe.exe:$DATA');
DeleteFile('C:\System Volume Information\_restore{8A8C6256-7D2C-48D9-A0B3-EC4FB00DB447}\RP466\A0107553.exe:exe.exe:$DATA');
DeleteFile('c:\windows\system32\svchost.exe:exe.exe:$DATA');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
DelCLSID('{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}');
ExecuteSysClean;
RebootWindows(true);
end.

 
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts

 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Program Files\Internet Explorer\svcnost.exe
O1 - Hosts file is located at: C:\WINDOWS\System32\drivers\etc\hosts