begin
 TerminateProcessByName('c:\users\Ф\appdata\roaming\lpspqdoj.exe');
DeleteFile('c:\users\Ф\appdata\roaming\lpspqdoj.exe');
DeleteFile('C:\Documents and Settings\Ф\AppData\Roaming\lpspqdoj.exe');
DeleteFile('C:\Documents and Settings\Ф\Application Data\lpspqdoj.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','PC Health Status');
ExecuteSysClean;
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

:Processes
explorer.exe

:Services

:Files
C:\WINDOWS\system32\csrcs.exe

:Reg

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DelBHO('{92077451-2DE5-4DAB-A358-2C9AA9F8E5CA}');
DeleteService('ICF');
DeleteFile('C:\WINDOWS\system32\icf.exe.exe:exe.exe');
DeleteFile('C:\WINDOWS\system32\csrcs.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunServices','csrcs');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','csrcs');
DeleteFile('C:\WINDOWS\system32\t8serv32.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','T8');
DeleteFile('Explorer.exe csrcs.exe');
DeleteFile('C:\WINDOWS\system32\glmf3.dll');
DeleteFile('C:\WINDOWS\system32\ctfnom.exe');
DeleteFile('C:\Documents and Settings\Администратор.ACER-027F9640B7\DoctorWeb\Quarantine\pfx2155.tmp.exe');
ExecuteSysClean;
ExecuteRepair(16);
RebootWindows(true);
end.