begin 
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\windows\temp\rarsfx0\deskspace.exe');
TerminateProcessByName('c:\documents and settings\admin\local settings\application data\{e0223dc8-b264-ea01-1290-cc6064edee21}\.exe');
DeleteFile('c:\documents and settings\admin\local settings\application data\{e0223dc8-b264-ea01-1290-cc6064edee21}\.exe');
QuarantineFile('C:\WINDOWS\system32\csrcs.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\msmedia.dll','');
QuarantineFile('C:\WINDOWS\system32\system.exe','');
QuarantineFile('c:\windows\temp\rarsfx0\deskspace.exe','');
QuarantineFile('C:\WINDOWS\TEMP\RarSFX0\deskspace1544.dll','');
DeleteFile('C:\WINDOWS\system32\csrcs.exe');
DeleteFile('C:\Documents and Settings\Admin\Application Data\msmedia.dll');
DeleteFile('C:\WINDOWS\system32\system.exe');
DeleteFile('c:\windows\temp\rarsfx0\deskspace.exe');
DeleteFile('C:\WINDOWS\TEMP\RarSFX0\deskspace1544.dll');
DeleteFile('C:\WINDOWS\system32\E1CF9F\1A9A1B.EXE');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','csrcs');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','system');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','DeskSpace');
DelCLSID('16ADF80D-C0FE-6C8E-F82A-0050D08D44BE');
DelCLSID('9D64F819-9380-8473-DAB2-702FCB3D7A3E');
RegKeyIntParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Control', 'WaitToKillServiceTimeout', 20000);
RegKeyIntParamWrite('HKCU', 'ControlPanel\Desktop', 'HungAppTimeout', 5000);
RegKeyIntParamWrite('HKCU', 'ControlPanel\Desktop', 'WaitToKillAppTimeout', 20000);
RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(6);
ExecuteRepair(8);
RegKeyIntParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1);
BC_Activate;
RebootWindows(true);
end.

begin
 DelBHO('{88888888-8888-8888-8888-888888888888}');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.