begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\windows\system32\20.exe');
 QuarantineFile('c:\RECYCLER\kos-2-3-41-0000010000-0000010000-0000010000-0100\wincache.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe','');
 QuarantineFile('c:\windows\system32\20.exe','');
 DeleteFile('c:\windows\system32\20.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe');
 DeleteFile('c:\RECYCLER\kos-2-3-41-0000010000-0000010000-0000010000-0100\wincache.exe');
 DeleteFile('C:\WINDOWS\system32\16.exe');
 DeleteFile('C:\WINDOWS\system32\20.exe');
 DeleteFile('C:\WINDOWS\system32\82.exe');
 RegKeyParamDel('HKLM','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
 ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\jodrive32.exe','');
 DeleteFile('C:\WINDOWS\jodrive32.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Config Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Config Setup');
 DeleteFile('C:\WINDOWS\system32\03.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\system32\fvrgmt.exe','');
 DeleteFile('C:\WINDOWS\system32\fvrgmt.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Driver Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Driver Setup');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

c:\documents and settings\networkservice\application data\qdtmw.exe (Worm.PalDot.Gen) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\0LYZKL23\sms[1].exe (Worm.Palevo.XGen) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\MEXJSBFW\sms[1].exe (Worm.Palevo.XGen) -> No action taken.
c:\documents and settings\user\application data\visdrive.exe (Worm.PalDot.Gen) -> No action taken.
c:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.

Заражённые ключи в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\StimulProfit (Adware.Agent) -> No action taken.

Заражённые параметры в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wors (Worm.Palevo) -> Value: wors -> No action taken.

Объекты реестра заражены:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.