begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearHostsFile;
 QuarantineFile('\\?\globalroot\systemroot\system32\d0Qg3TE.exe','');
 QuarantineFile('\\?\globalroot\systemroot\system32\JkvRgRX.exe','');
 DeleteFile('\\?\globalroot\systemroot\system32\JkvRgRX.exe');
 DeleteFile('\\?\globalroot\systemroot\system32\d0Qg3TE.exe');
 DeleteFile('C:\Program Files\Common Files\Program Shared\Isass.exe');
RegKeyStrParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'UserInit', GetEnvironmentVariable('WinDir')+'\system32\userinit.exe,'); 
BC_ImportAll;
 ExecuteRepair(16);
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
BC_Activate;
RebootWindows(true);
end.

begin 
 ExecuteRepair(13);
RebootWindows(true);
end.

Зараженные параметры в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe (Trojan.FakeMS) -> No action taken.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe (Trojan.FakeMS) -> No action taken.

Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.