begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DeleteService('dhzae4ahng47');
 DeleteFile('C:\WINDOWS\system32\kussynoozoos.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bettit.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','mojoulab');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','mojoulab');
 DeleteFile('C:\Documents and Settings\M_DB\Application Data\cift.exe');
 DeleteFile('C:\Documents and Settings\M_DB\Application Data\cift.exe,explorer.exe,C:\Documents and Settings\Администратор\Application Data\cift.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\cift.exe,C:\Documents and Settings\administrator\Application Data\cift.exe,C:\Documents and Settings\M_DB\ctfmon.exe,C:\DOCUME~1\M_DB\LOCALS~1\Temp\576.exe,explorer.exe,C:\Documents and Settings\M_DB\Application Data\cift.exe');
 DeleteFile('c:\windows\system32\userini.exe');
 DeleteFile('C:\WINDOWS\system32\sysguard.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-21-3768267562-3218047720-2088387314-1009\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','System Profiling');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','System Profiling');
 RegKeyParamDel('HKEY_USERS','S-1-5-21-3768267562-3218047720-2088387314-1009\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
 DeleteFile('\\?\globalroot\systemroot\system32\fSAtxpN.exe');
 DeleteFile('c:\windows\explorer.exe:userini.exe:$DATA');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\?\globalroot\systemroot\system32\fSAtxpN.exe,

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('c:\windows\temp\wpv351275553768.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
ExecuteSysClean;
RebootWindows(true);
end.

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('c:\windows\temp\wpv601275553103.exe');
DeleteFile('C:\WINDOWS\explorer.exe:userini.exe');
DeleteFileMask('c:\windows\temp ','*.* ',true);
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','userini');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3768267562-3218047720-2088387314-1009\Software\Microsoft\Windows\CurrentVersion\Run','userini');
RegKeyParamDel('HKEY_USERS','S-1-5-21-3768267562-3218047720-2088387314-1009\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','userini');
DeleteFile('C:\WINDOWS\system32\userini.exe');
DeleteFile('c:\windows\explorer.exe:userini.exe:$DATA');
BC_DeleteFile('c:\windows\temp\wpv601275553103.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

O4 - HKLM\..\Run: [userini] C:\WINDOWS\explorer.exe:userini.exe
O4 - HKLM\..\Policies\Explorer\Run: [userini] C:\WINDOWS\explorer.exe:userini.exe