F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\vThPbMT.exe,\\?\globalro

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ExecuteSysClean;
DeleteFile('C:\WINDOWS\system32\2MSx6Sy.exe'); 
DeleteFile('C:\WINDOWS\system32\b57s2Ss.exe'); 
DeleteFile('C:\WINDOWS\system32\Cw6ZELd.exe');
DeleteFile('C:\WINDOWS\system32\g3hs57x.exe'); 
DeleteFile('C:\WINDOWS\system32\lxqA2FK.exe'); 
DeleteFile('C:\WINDOWS\system32\OrmoR9N.exe');
DeleteFile('C:\WINDOWS\system32\RG0zg1F.exe'); 
DeleteFile('C:\System Volume Information\_restore{50A6A978-B960-4E6D-98CB-57E302A97044}\RP3\A0000192.exe'); 
ExecuteRepair(20); 
RebootWindows(true);
end.

 
var
 Lines : TStrings;
 i : integer;
begin
 Lines := TStringList.Create;
 SearchFiles('%system32%', '*.exe', Lines, true, false);
 for i:= 0 to Lines.Count-1 do
  AddToLog(Lines[i]+', Size='+inttostr(GetFileSize(Lines[i])));
 Lines.Free;
SaveLog(GetAVZDirectory + 'file.log');
end.