R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\897820e.exe,\\?\globalroot\systemroot\system32\zQFENGa.exe,
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Policies\Explorer\Run: [systemxp] C:\WINDOWS\systemxp.exe
O4 - HKLM\..\Policies\Explorer\Run: [winexp] C:\WINDOWS\winexp.exe
O4 - HKLM\..\Policies\Explorer\Run: [taskmsgr] C:\WINDOWS\taskmsgr.exe

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\windows\winlogin.exe');
 TerminateProcessByName('c:\windows\winexp.exe');
 TerminateProcessByName('c:\windows\systemxp.exe');
QuarantineFile('C:\WINDOWS\taskmsgr.exe','');
DeleteFile('C:\WINDOWS\taskmsgr.exe');
 QuarantineFile('C:\WINDOWS\winlogin.exe','');
 QuarantineFile('C:\Program Files\Ask.com\UpdateTask.exe','');
 QuarantineFile('C:\Program Files\Ask.com\GenericAskToolbar.dll','');
 QuarantineFile('\\?\globalroot\systemroot\system32\zQFENGa.exe','');
 QuarantineFile('C:\WINDOWS\system32\897820e.exe','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\tap0901.sys','');
 QuarantineFile('c:\windows\winlogin.exe','');
 QuarantineFile('c:\windows\winexp.exe','');
 QuarantineFile('c:\windows\systemxp.exe','');
 DeleteFile('c:\windows\systemxp.exe');
 DeleteFile('c:\windows\winexp.exe');
 DeleteFile('c:\windows\winlogin.exe');
 DeleteFile('C:\WINDOWS\system32\897820e.exe');
 DeleteFile('\\?\globalroot\systemroot\system32\zQFENGa.exe');
 DeleteFile('C:\Program Files\Ask.com\GenericAskToolbar.dll');
 DeleteFile('C:\Program Files\Ask.com\UpdateTask.exe');
 DeleteFile('C:\WINDOWS\winlogin.exe');
 DeleteFile('C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job');
 DeleteFile('C:\WINDOWS\Tasks\system.job');
DelBHO('{00000000-6E41-4FD3-8538-502F5495E5FC}');
 DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
 DelBHO('{D4027C7F-154A-4066-A1AD-4243D8127440}');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(6);
ExecuteRepair(20);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.