begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\documents and settings\admin\application data\hotfix.exe');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\srtserv\mshimun.exe','');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\ntspecd\mvurym.exe','');
 DeleteFile('C:\WINDOWS\system32\dllcache\tahoma.ttf:exaSnrGYA9hVhaOr4MAK');
 DeleteFile('c:\documents and settings\admin\application data\hotfix.exe');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\ntspecd\mvurym.exe');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\srtserv\mshimun.exe');
 DeleteFile('C:\WINDOWS\Installer\495e4.msi');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ntspecd');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','srtserv');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 RegKeyIntParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteRepair(6);
 RegKeyIntParamWrite( 'HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1);
 ExecuteRepair(8);
 ExecuteRepair(16);
 ExecuteRepair(17);
 ExecuteWizard('SCU', 2, 2, true);
RebootWindows(true);
end.