begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\{4b09767e-0414-c454-6399-07e0b07fe8d4}\.exe');
 DeleteFile('c:\documents and settings\admin\local settings\application data\{4b09767e-0414-c454-6399-07e0b07fe8d4}\.exe');
 DeleteFileMask('c:\documents and settings\admin\local settings\application data\{4b09767e-0414-c454-6399-07e0b07fe8d4}', '*.*', true);
 DeleteDirectory('c:\documents and settings\admin\local settings\application data\{4b09767e-0414-c454-6399-07e0b07fe8d4}');
 DeleteFile('c:\documents and settings\admin\application data\j18vs5j5.exe');
 DeleteFile('c:\documents and settings\admin\application data\winlogon.exe');
 TerminateProcessByName('C:\Documents and Settings\Admin\Application Data\Quekti\zyfua.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Quekti\zyfua.exe');
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\Quekti', '*.*', true);
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\Quekti');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Senzen.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\3.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\811500396.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\476635400.exe');
QuarantineFile('C:\WINDOWS\Domino.exe','');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,2,true);
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ctel.ru/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://webalta.ru

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore', 'DisableSR', 0);
 DelCLSID('{7ACF28CC-ACEF-ED8D-EED4-AB87AB81EEDF}');
 DelCLSID('{0C93AEE8-0C0F-BC27-276E-CFCE4F4DF13D}');
 TerminateProcessByName('c:\documents and settings\admin\application data\849752414.exe');
 DeleteFile('c:\documents and settings\admin\application data\849752414.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\040503147.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ProtSys');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Win Defender');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Win Defender');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Win Defender');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SystemProtecter');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ProtectSys');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ProtectSys');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NKRY12LW45IMP');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','NKRY12LW45IMP');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','NKRY12LW45IMP');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','{81EEEE12-13BA-97AB-7F5E-8BCD5721E591}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Windows Defender');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Kernel Drv');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Kernel Drv');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,2,true);
BC_Activate;
RebootWindows(true);
end.

begin
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Control\LSA','RestrictAnonymous', 2);
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Senzen.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Windows Defender');
RebootWindows(true);
end.