begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 ClearHostsFile;
 TerminateProcessByName('c:\documents and settings\admin\application data\netprotocol.exe');
 TerminateProcessByName('c:\documents and settings\admin\application data\lsass.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\yandex\updater\fixhosts.exe');
 QuarantineFile('C:\WINDOWS\system32\windebug32.exe','');
 QuarantineFile('C:\systemhost\24FC2AE3B94.exe','');
 QuarantineFile('c:\documents and settings\admin\application data\netprotocol.exe','');
 QuarantineFile('c:\documents and settings\admin\application data\lsass.exe','');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\yandex\updater\fixhosts.exe','');
 DeleteFile('c:\documents and settings\admin\local settings\application data\yandex\updater\fixhosts.exe');
 DeleteFile('c:\documents and settings\admin\application data\lsass.exe');
 DeleteFile('C:\systemhost\24FC2AE3B94.exe');
 DeleteFile('C:\WINDOWS\system32\windebug32.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\netprotocol.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Netprotocol');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YI9B2F0F2EXG1JWHL');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Windows Debugger 32');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteWizard('TSW',2,3,true);
RebootWindows(true);
end.