begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('Hov64');
DeleteFile('%System32%\Drivers\etc\hosts');
DeleteFile('c:\documents and settings\Администратор\application data\f531bcf196ba29fa638a47d4397b4293\gotnewupdate005.exe');
DeleteFile('c:\windows\system32\drivers\svchost.exe');
DeleteFile('c:\docume~1\9335~1\locals~1\temp\swv5.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\Hov64.sys');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Windows Firewall');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Windows Firewall');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','gotnewupdate005.exe');
DeleteFile('C:\Documents and Settings\Администратор\Application Data\Kuer\haboa.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','{42503D4E-D516-B9AA-FB69-DE65692234A2}');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SVCHOST.EXE');
DeleteFile('C:\WINDOWS\system32\player.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Player');
DeleteFile('C:\WINDOWS\system32\sdra64.exe');
DeleteFile('C:\OOP\PPP\may1x2.exe');
DeleteFile('C:\DODA\BEEK\april2x4.exe');
DeleteFile('C:\EASTER\ERASER\Easter.exe');
DeleteFile('C:\NORTON\U-34543ANTI-9998887776-23234532-565\nav.exe');
DeleteFile('C:\WINDOWS\system32\cmdow.exe');
DeleteFile('C:\Documents and Settings\Администратор\ddaqaeg7.exe');
DelCLSID('{64KLC5K0-4OPM-00WE-AAX8-27EF1D183366}');
DelCLSID('{67KLN5J0-4OPM-33WE-AAX5-21KC2A1110023}');
DelCLSID('{67KLN5J0-4OPM-33WE-AAX5-21KC2A1112233}');
DelCLSID('{67KLN5J0-4OPM-33WE-AAX5-21KC2A2312233}');
ExecuteSysClean;
ExecuteRepair(6);
ExecuteRepair(13);
RebootWindows(true);
end.

 
O20 - Winlogon Notify: kbupdate - Invalid registry found

begin
 DeleteFile('C:\thumbs.db');
RebootWindows(true);
end.