begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('\Device\HarddiskVolume1\Documents and Settings\Admin\Local Settings\Temp\6FF137BE-5A858F62-2A5E6E30-9952DB98\f78cc_xp.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\{dbf7bc5e-9602-2ce9-c338-adebf28cbce3}\.exe');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\oekx.exe,explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\psysnew.exe','');
 QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\5AKqyMB2.sys','');
 QuarantineFile('\Device\HarddiskVolume1\Documents and Settings\Admin\Local Settings\Temp\6FF137BE-5A858F62-2A5E6E30-9952DB98\f78cc_xp.exe','');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\{dbf7bc5e-9602-2ce9-c338-adebf28cbce3}\.exe','');
 DeleteFile('c:\documents and settings\admin\local settings\application data\{dbf7bc5e-9602-2ce9-c338-adebf28cbce3}\.exe');
 DeleteFile('\Device\HarddiskVolume1\Documents and Settings\Admin\Local Settings\Temp\6FF137BE-5A858F62-2A5E6E30-9952DB98\f78cc_xp.exe');
 DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\5AKqyMB2.sys');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\oekx.exe,explorer.exe,C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\psysnew.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteRepair(16);
 ExecuteWizard('SCU', 2, 2, true);
 ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll','');
 QuarantineFile('C:\Documents and Settings\44\Application Data\elwb.exe','');
 QuarantineFile('E:\NTGLM7X.sys','');
 QuarantineFile('E:\INSTALL\GMSIPCI.SYS','');
 DeleteFile('E:\INSTALL\GMSIPCI.SYS');
 DeleteFile('E:\NTGLM7X.sys');
 DeleteFile('C:\Documents and Settings\44\Application Data\elwb.exe');
 DeleteFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll');
 DelBHO('{700259D7-1666-479a-93B1-3250410481E8}');
 DelBHO('{58ECB495-38F0-49cb-A538-10282ABF65E7}');
 DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
 DelBHO('{4B3803EA-5230-4DC3-A7FC-33638F3D3542}');
 DelBHO('{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Micr osoft\Windows NT\CurrentVersion\Winlogon','Taskman');
 DeleteService('SetupNTGLM7X');
 DeleteService('GMSIPCI');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.

C:\WINDOWS\system32\drivers\sp_rsdrv2.sys

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll','');
 DeleteFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll');
 BC_DeleteFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll');
 DelCLSID('{4D25FB7A-8902-4291-960E-9ADA051CFBBF}');
 DeleteFileMask('C:\PROGRA~1\Crawler\Toolbar\', '*.*', true);
 DeleteDirectory('C:\PROGRA~1\Crawler\Toolbar');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.