begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('L‘|xі.exe','');
 DeleteFile('C:\WINDOWS\system32\algn.tso');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\svchosts.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Updates');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Updates');
 DeleteFile('L‘|xі.exe');
 DeleteFile('C:\Program Files\Internet Explorer\rasadhlp.dll');
 DeleteFile('C:\WINDOWS\system32\netprotocol.exe');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
BC_Activate;
RebootWindows(true);
end.

R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [Generic Host for Win32 Services] L‘|xі
O4 - HKUS\S-1-5-19\..\RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,OnceFirstLogonInstall,0 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ZZZZ1_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,OnceFirstLogonInstall,0 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ZZZZ2_FirstLogonSetting] %SystemRoot%\System32\rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\custom.inf,NewUserFirstLogonInstall,0 (User 'Default user')
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

Зараженные ключи в реестре:
HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> No action taken.

Зараженные файлы:
C:\Documents and Settings\Admin\Local Settings\Temp\gEEL.exe (Spyware.Passwords.XGen) -> No action taken.
C:\Documents and Settings\Admin\Local Settings\Temp\30D.tmp (Trojan.Dropper.Gen) -> No action taken.
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\R7SF39VL\n002106201r0019R8942591aXf046583fYbcd14b5eZ0100f07030dP000000081[1] (Spyware.Passwords.XGen) -> No action taken.
C:\WINDOWS\innounp.exe (Malware.Packer.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\DVDCopy5_SILVER\3rdPartyApp\GoogleDesktopSearch\GoogleDesktopSearchSetup_ja.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\DVDCopy5_SILVER\3rdPartyApp\GoogleDesktopSearch\GoogleDesktopSearchSetup_zh-cn.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\DVDCopy5_SILVER\3rdPartyApp\GoogleDesktopSearch\GoogleDesktopSearchSetup_zh-tw.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\WinDVD8_SILVER\3rdpartyapp\GoogleDesktopSearch\GoogleDesktopSearchSetup_ja.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\WinDVD8_SILVER\3rdpartyapp\GoogleDesktopSearch\GoogleDesktopSearchSetup_zh-cn.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\Ulead_DVD_Movie_Factory_6.0_PLUS\WinDVD8_SILVER\3rdpartyapp\GoogleDesktopSearch\GoogleDesktopSearchSetup_zh-tw.exe (Trojan.Agent.Gen) -> No action taken.
D:\dawnloads\СПДС_6\Patch_SPDS_GraphiCS\Patch СПДС GraphiCS.exe (Trojan.Dropper.PGen) -> No action taken.
D:\Distrib\MC7\Spectrum Micro-CAP V7.1.6\crack\mc7_crack.exe (Trojan.Bancos) -> No action taken.
D:\Новая папка\РОБЕРТ\БОТВА\Электроника\DOPOLNENIE\MC7\Spectrum Micro-CAP V7.1.6\crack\mc7_crack.exe (Trojan.Bancos) -> No action taken.
C:\Program Files\Outlook Express\rasadhlp.dll (Trojan.PWS) -> No action taken.