R3 - URLSearchHook: (no name) - - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{DFDC8970-FD66-4385-B8C0-835A4AA1DA00}');
 DelBHO('{71F65890-5ED6-11d4-9665-00E02962D81A}');
 DelBHO('{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}');
 DelBHO('{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}');
 DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\VSpFo3PQ.sys');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\cift.exe');
 DeleteFile('C:\Program Files\DrWeb\Infected.!!!\svchost.exe:exe.exe.56B177FD:$DATA');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(1);
BC_Activate;
end.

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bama.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','moozu');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','moozu');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zeze.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','cogicy');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','cogicy');
 DeleteFile('C:\Program Files\Bonjour\mDNSResponder.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\Eventlog\Application\Bonjour Service','EventMessageFile');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('TSW',2,2,true);
RebootWindows(true);
end.