begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 ClearQuarantine;
 TerminateProcessByName('c:\heap41a\svchost.exe');
 QuarantineFile('C:\WINDOWS\system32\9.tmp','');
 QuarantineFile('C:\WINDOWS\system32\8.tmp','');
 QuarantineFile('C:\WINDOWS\system32\3.tmp','');
 QuarantineFile('c:\heap41a\svchost.exe','');
 DeleteFile('c:\heap41a\svchost.exe');
 DeleteFile('C:\WINDOWS\system32\3.tmp');
 DeleteFile('C:\WINDOWS\system32\8.tmp');
 DeleteFile('C:\WINDOWS\system32\9.tmp');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
RegKeyStrParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'UserInit', GetEnvironmentVariable('WinDir')+'\system32\userinit.exe,');
RebootWindows(true);
end.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\status (Trojan.Agent) -> Value: status -> No action taken.
c:\heap41a (Trojan.Agent) -> No action taken.
c:\heap41a\offspring (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\AdCache (AdWare.Cydoor) -> No action taken.
c:\downloads\avz4\avz4\quarantine\2011-08-23\avz00004.dta (Worm.Muha) -> No action taken.
c:\heap41a\2.mp3 (Trojan.Agent) -> No action taken.
c:\heap41a\drivelist.txt (Trojan.Agent) -> No action taken.
c:\heap41a\Icon.ico (Trojan.Agent) -> No action taken.
c:\heap41a\std.txt (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\winlogon.Del (Heuristics.Reserved.Word.Exploit) -> No action taken.
c:\WINDOWS\system32\oobe\antiwpa_crypt.dll (Hacktool) -> No action taken.