begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{1E796980-9CC5-11D1-A83F-00C04FC99D61}');
 DeleteFile('C:\autorun.exe');
 DeleteFile('C:\autorun.wsh');
 DeleteFile('E:\autorun.inf');
 DeleteFile('C:\RESTORE\k-1-3542-4232123213-7676767-8888886\BLUE.exe');
 DeleteFile('C:\Ozzy\Osbourne\IaMJusT.exe');
 DeleteFile('C:\Documents and Settings\Yulia\Local Settings\Temp\~DF8E79.tmp')
 DeleteFile('C:\System Volume Information\_restore{62E8B537-D49E-4F22-B67A-DBD616C60577}\RP138\A0045587.exe')
 DeleteFile('C:\System Volume Information\_restore{62E8B537-D49E-4F22-B67A-DBD616C60577}\RP140\A0047006.exe
')
 DeleteFile('C:\System Volume Information\_restore{62E8B537-D49E-4F22-B67A-DBD616C60577}\RP141\A0047090.scr
')
 DeleteFile('C:\System Volume Information\_restore{62E8B537-D49E-4F22-B67A-DBD616C60577}\RP142\A0047187.exe
')
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

 
F2 - REG:system.ini: Shell=%SystemRoot%\system32\user32.exe
F2 - REG:system.ini: UserInit=E:\WINDOWS\system32\userinit.exe,E:\WINDOWS\system32\sdra64.exe,
O21 - SSODL: WebCheck - {FF4EC53A-CA51-9A39-6CDD-5FFB26FB445C} - overlapp32.dll (file missing)

 
begin
DeleteFile('E:\WINDOWS\system32\user32.exe');
DeleteFile('E:\WINDOWS\system32\sdra64.exe');
end.