R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxi.biz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.qip.ru
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxi.biz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxi.biz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxi.biz
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.qip.ru/ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=a61295fb0000000000000016eb1040c0&tlver=1.4.19.19&affID=17160
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = vkontakte.ru;www.vkontakte.ru;vk.com;www.vk.com
O4 - HKCU\..\Run: [winxgz] "C:\Users\1111\AppData\Roaming\archsoft\arustart.exe" autostart

begin
 QuarantineFile('C:\Users\1111\AppData\Roaming\archsoft\arustart.exe','');
 QuarantineFile('C:\Program Files\Wyeke\wyeke.dll','');
 QuarantineFile('c:\programdata\wyeke\wyeke199.exe','');
 TerminateProcessByName('c:\programdata\wyeke\wyeke199.exe');
 QuarantineFile('c:\program files\wyeke\wyeke.exe','');
 TerminateProcessByName('c:\program files\wyeke\wyeke.exe');
 DeleteFile('c:\program files\wyeke\wyeke.exe');
 DeleteFile('c:\programdata\wyeke\wyeke199.exe');
 DeleteFile('C:\Program Files\Wyeke\wyeke.dll');
 DeleteFile('C:\Users\1111\AppData\Roaming\archsoft\arustart.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','winxgz');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 end.