O4 - HKLM\..\Run: [winsock.exe] c:\windows\system32\winsock.exe
O4 - HKLM\..\Run: [SysSrv] C:\Documents and Settings\All Users\Application Data\winsys\svrchost.exe
O4 - HKLM\..\RunServices: [winsock.exe] c:\windows\system32\winsock.exe
O4 - HKLM\..\RunOnce: [AD Network] "C:\Documents and Settings\Admin\Local Settings\Application Data\{37BE00DC-A79F-D004-F7C3-1F78B3D69919}\.exe" ?
O4 - HKLM\..\RunServicesOnce: [winsock.exe] c:\windows\system32\winsock.exe
O4 - HKCU\..\Run: [winsock.exe] c:\windows\system32\winsock.exe

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('c:\windows\system32\winsock.exe','');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\winsys\svrchost.exe','');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\{37be00dc-a79f-d004-f7c3-1f78b3d69919}\.exe','');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\{37be00dc-a79f-d004-f7c3-1f78b3d69919}\.exe');
 DeleteFile('c:\documents and settings\admin\local settings\application data\{37be00dc-a79f-d004-f7c3-1f78b3d69919}\.exe');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\winsys\svrchost.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SysSrv');
 DeleteFile('c:\windows\system32\winsock.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','winsock.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunServices','winsock.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunServicesOnce','winsock.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','winsock.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.