begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('c:\windows\dhcp\svchost.exe');
 TerminateProcessByName('c:\windows\system32\3361\svchost.exe');
 TerminateProcessByName('c:\windows\system32\sopidkc.exe');
 TerminateProcessByName('c:\windows\system32\reader_s.exe');
 TerminateProcessByName('c:\documents and settings\Админ\reader_s.exe');
 TerminateProcessByName('c:\windows\temp\jks18.tmp');
 TerminateProcessByName('c:\windows\temp\bna.tmp');
 TerminateProcessByName('c:\windows\system32\ashevtsvc.exe');
 DeleteService('restore');
 DeleteService('protect');
 DeleteService('AshEvtSvc');
 DeleteService('6to4');
 DeleteFile('c:\windows\system32\ashevtsvc.exe');
 DeleteFile('c:\windows\temp\bna.tmp');
 DeleteFile('c:\windows\temp\jks18.tmp');
 DeleteFile('c:\documents and settings\Админ\reader_s.exe');
 DeleteFile('c:\windows\system32\reader_s.exe');
 DeleteFile('c:\windows\system32\sopidkc.exe');
 DeleteFile('c:\windows\system32\3361\svchost.exe');
 DeleteFile('c:\windows\dhcp\svchost.exe');
 DeleteFile('C:\WINDOWS\system32\gofax.dll');
 DeleteFile('C:\WINDOWS\system32\IPHACTION.dll');
 DeleteFile('c:\windows\system32\msncache.dll');
 DeleteFile('C:\WINDOWS\System32\reader_s.exe');
 DeleteFile('C:\WINDOWS\system32\saflks.dll');
 DeleteFile('C:\WINDOWS\system32\saflks32.dll');
 DeleteFile('C:\WINDOWS\system32\tcpcon.dll');
 DeleteFile('C:\WINDOWS\TEMP\BNA.tmp');
 DeleteFile('C:\WINDOWS\TEMP\jks18.tmp');
 DeleteFile('C:\WINDOWS\System32\drivers\protect.sys');
 DeleteFile('C:\WINDOWS\system32\drivers\restore.sys');
 DeleteFile('C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\916653139.exe');
 DeleteFile('C:\Documents and Settings\Админ\reader_s.exe');
 DeleteFile('C:\WINDOWS\services.exe');
 DeleteFile('adcsyoyj.dll');
 DeleteFile('c:\progra~1\ThunMail\testabd.dll');
 DeleteFile('saflks.dll');
 DeleteFile('gofax.dll');
 DeleteFile('C:\WINDOWS\Temp\VRT3.tmp');
 DeleteFile('C:\WINDOWS\Temp\ldfghryjbkjhaehljhhfbee44.exe');
 DeleteFile('C:\WINDOWS\system32\tpszxyd.sys');
 DeleteFile('C:\WINDOWS\system32\dpcxool64.sys');
 DeleteFile('C:\System Volume Information\_restore{A49BB6BE-756A-480D-ACA9-58F41AD3B83C}\RP6\A0018733.sys');
 DeleteFile('C:\System Volume Information\_restore{A49BB6BE-756A-480D-ACA9-58F41AD3B83C}\RP6\A0017733.sys');
 DeleteFile('C:\System Volume Information\_restore{A49BB6BE-756A-480D-ACA9-58F41AD3B83C}\RP6\A0016732.sys');
 DeleteFile('C:\System Volume Information\_restore{A49BB6BE-756A-480D-ACA9-58F41AD3B83C}\RP6\A0015734.sys');
 DeleteFile('C:\System Volume Information\_restore{A49BB6BE-756A-480D-ACA9-58F41AD3B83C}\RP5\A0015644.sys');
 DeleteFile('C:\Program Files\Internet Explorer\setupapi.dll');
 DelAutorunByFileName('C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\916653139.exe');
 DelAutorunByFileName('C:\WINDOWS\services.exe');
 DelAutorunByFileName('c:\windows\system32\3361\svchost.exe');
 DelAutorunByFileName('C:\WINDOWS\services.exe');
 DelAutorunByFileName('c:\windows\system32\reader_s.exe');
 DelAutorunByFileName('c:\documents and settings\Админ\reader_s.exe');
 DelWinlogonNotifyByFileName('adcsyoyj.dll');
 DelWinlogonNotifyByFileName('saflks.dll');
 DelCLSID('{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}');
 DelBHO('{56BB6D01-7BD5-4458-A4AE-F03DF643D6EE}');
 DeleteFileMask('C:\WINDOWS\Temp', '*.*', true);
 ClearQuarantine;
 ClearIECache;
ExecuteRepair(6);
ExecuteRepair(11);
ExecuteRepair(17);
ExecuteSysClean;
RebootWindows(true);
end.