R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxxi.biz
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxxi.biz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxxi.biz
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxxi.biz
O4 - HKLM\..\Run: [fastad] "C:\Users\ys.sergeev\AppData\Roaming\fastad\fastad.exe" autostart
O4 - HKCU\..\Run: [winxgz] "C:\Users\ys.sergeev\AppData\Roaming\abusy\zipsmart.exe" autostart

begin
 QuarantineFile('C:\Users\ys.sergeev\AppData\Roaming\fastad\fastad.exe','');
 QuarantineFile('C:\Users\ys.sergeev\AppData\Roaming\abusy\zipsmart.exe','');
 QuarantineFile('c:\users\ys.sergeev\appdata\roaming\fastad\fastad.exe','');
 TerminateProcessByName('c:\users\ys.sergeev\appdata\roaming\fastad\fastad.exe');
 DeleteFile('c:\users\ys.sergeev\appdata\roaming\fastad\fastad.exe');
 DeleteFile('C:\Users\ys.sergeev\AppData\Roaming\abusy\zipsmart.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','winxgz');
 DeleteFile('C:\Users\ys.sergeev\AppData\Roaming\fastad\fastad.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','fastad');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 begin
 CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
 end.