begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('D:\thumbs.db','');
 QuarantineFile('D:\systemhost.exe\systemhost.exe','');
 QuarantineFile('D:\Documents and Settings\a\Start Menu\Programs\Startup\chkntfs.exe','');
 DeleteFile('D:\Documents and Settings\a\Application Data\netprotocol.exe');
 DeleteFile('D:\Documents and Settings\a\Start Menu\Programs\Startup\chkntfs.exe');
 DeleteFile('D:\WINDOWS\system32\d5b2fd66.exe');
 DeleteFile('D:\WINDOWS\system32\zjrnpd.exe');
 DeleteFile('D:\systemhost.exe\systemhost.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Netprotocol');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','systemhost.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','systemhost.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run','systemhost.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','systemhost.exe');
 DeleteFile('D:\thumbs.db');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(1);
ExecuteRepair(20);
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('D:\Documents and Settings\a\Start Menu\Programs\Startup\chkntfs.exe');
 BC_DeleteFile('D:\Documents and Settings\a\Start Menu\Programs\Startup\chkntfs.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('D:\WINDOWS\system32\7759829a.exe');
RegKeyStrParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'UserInit', GetEnvironmentVariable('SystemRoot')+'\system32\userinit.exe,');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.