begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\System Volume Information\_restore{E18F84CA-397E-4704-B192-4B8939448610}\RP151\A0105817.exe','');
 QuarantineFile('C:\System Volume Information\_restore{E18F84CA-397E-4704-B192-4B8939448610}\RP149\A0101454.exe','');
 QuarantineFile('C:\WINDOWS\ime\svchost.exe','');
 QuarantineFile('C:\DOCUME~1\9335~1\LOCALS~1\Temp\Rar$EX02.968\Christmas.exe','');
 QuarantineFile('C:\WINDOWS\system32\019.tmp','');
 QuarantineFile('c:\program files\common files\spigot\search settings\searchsettings.exe','');
 TerminateProcessByName('c:\program files\common files\spigot\search settings\searchsettings.exe');
 DeleteFile('c:\program files\common files\spigot\search settings\searchsettings.exe');
 DeleteFile('C:\WINDOWS\system32\019.tmp');
 DeleteFile('C:\DOCUME~1\9335~1\LOCALS~1\Temp\Rar$EX02.968\Christmas.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ChristmasTree');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SearchSettings');
 DeleteFile('C:\WINDOWS\ime\svchost.exe');
 DeleteService('kfcel');
 DeleteService('etiog');
 DeleteFile('C:\System Volume Information\_restore{E18F84CA-397E-4704-B192-4B8939448610}\RP149\A0101454.exe');
 DeleteFile('C:\System Volume Information\_restore{E18F84CA-397E-4704-B192-4B8939448610}\RP151\A0105817.exe');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 end.

begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 end.

var j:integer; NumStr:string;
begin
for j:=0 to 999 do
 begin
    if j=0 then
        NumStr:='CurrentControlSet' else 
        if j<10 then
            NumStr:='ControlSet00'+IntToStr(j) else
            if j<100 then
                NumStr:='ControlSet0'+IntToStr(j) else
                NumStr:='ControlSet'+IntToStr(j);
 if RegKeyExistsEx('HKLM', 'SYSTEM\'+NumStr+'\Services\BITS') then
  begin
  RegKeyResetSecurity('HKLM', 'SYSTEM\'+NumStr+'\Services\BITS');
  RegKeyStrParamWrite('HKLM', 'SYSTEM\'+NumStr+'\Services\BITS', 'ImagePath', '%SystemRoot%\System32\svchost.exe -k netsvcs');
  AddToLog('Значение параметра ImagePath в разделе реестра HKLM\SYSTEM\'+NumStr+'\Services\BITS исправлено на оригинальное.');
  end;
 if RegKeyExistsEx('HKLM', 'SYSTEM\'+NumStr+'\Services\wuauserv') then
  begin 
  RegKeyResetSecurity('HKLM', 'SYSTEM\'+NumStr+'\Services\wuauserv');
  RegKeyStrParamWrite('HKLM', 'SYSTEM\'+NumStr+'\Services\wuauserv', 'ImagePath', '%SystemRoot%\System32\svchost.exe -k netsvcs');
  AddToLog('Значение параметра ImagePath в разделе реестра HKLM\SYSTEM\'+NumStr+'\Services\wuauserv исправлено на оригинальное.');
  end;
 end;
SaveLog(GetAVZDirectory + 'fystemRoot.log');
end.