begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\documents and settings\ralph\application data\visdrive.exe');
 TerminateProcessByName('c:\pdf.exe');
 QuarantineFile('C:\RECYCLER\S-1-5-21-8994936646-7739738027-091631194-7353\msdrive.exe','');
 DeleteFile('c:\documents and settings\ralph\application data\visdrive.exe');
 BC_DeleteFile('c:\documents and settings\ralph\application data\visdrive.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-8994936646-7739738027-091631194-7353\msdrive.exe');
 DeleteFile('C:\WINDOWS\jodrive32.exe');
 DeleteFile('C:\WINDOWS\ndll.exe');
 DeleteFile('C:\pdf.exe');
 DeleteFile('E:\autorun.inf');
 DeleteFile('E:\RECYCLERTEMP\autorun.exe');
 DeleteFile('C:\csetup.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','12CFG214-K641-12SF-N85P');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Config Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Config Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','oo');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RegKeyStrParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'UserInit', GetEnvironmentVariable('WinDir')+'\system32\userinit.exe,'); 
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteWizard('SCU', 2, 2, true);
 ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.