begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('C:\WINDOWS\system32\EXPLORER.EXE');
DeleteFile('C:\WINDOWS\system32\msfir80.exe');
DeleteFile('c:\windows\system32\algssl.exe');
DeleteFile('C:\autorun.inf');
DeleteFile('C:\sal.xls.exe');
ExecuteSysClean;
 ExecuteRepair(1);
 ExecuteRepair(6);
RebootWindows(true);
end.

O4 - HKLM\..\Run: [IMJPMIG8.2] msime80.exe
O4 - HKLM\..\Run: [XP-4FF57DDC] C:\WINDOWS\system32\XP-4FF57DDC.EXE
O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKCU\..\Run: [MsServer] msfir80.exe
O4 - Startup: ЎЎЎЎЎЎ.lnk = C:\WINDOWS\system32\XP-4FF57DDC.EXE

 
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('c:\windows\system32\algssl.exe');
 DeleteFile('c:\windows\system32\xp-4ff57ddc.exe');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\com.run');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\dp1.fne');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\eAPI.fne');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\internet.fne');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\krnln.fnr');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\RegEx.fnr');
 DeleteFile('C:\DOCUME~1\08E2~1\LOCALS~1\Temp\E_4\shell.fne');
 DeleteFile('C:\WINDOWS\system32\XP-4FF57DDC.EXE');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','XP-4FF57DDC');
 DeleteFile('C:\WINDOWS\system32\msfir80.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MsServer');
 DeleteFile('C:\WINDOWS\system32\msime80.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IMJPMIG8.2');
 DeleteFile('C:\autorun.inf');
 DeleteFile('C:\sal.xls.exe');
 DeleteFileMask('%temp%','*.* ',true);
ExecuteSysClean;
ExecuteWizard('TSW', 2, 2, true);
SetAVZPMStatus(True);
RebootWindows(true);
end.