Cuadlv.pif, bxex.exe (меняет имя)

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 50000, false);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\system32\XP-D41D8CD9.EXE ','');
 QuarantineFile('C:\Documents and Settings\Сергей\Главное меню\Программы\Автозагрузка\igfxtray.exe','');
 QuarantineFile('C:\WINDOWS\enс.ini','');
 QuarantineFile('H:\slrmgr.exe','');
 QuarantineFile('H:\tnjh.exe','');
 QuarantineFile('I:\vtcgwa.pif','');
 QuarantineFile('D:\xdhpg.exe','');
 QuarantineFile('H:\ikohbg.exe','');
 QuarantineFile('H:\cuadlv.pif','');
 QuarantineFile('E:\ncuu.pif','');
 QuarantineFile('C:\jisp.exe','');
 QuarantineFile('H:\ajtuam.exe','');
 QuarantineFile('C:\mwpyc.exe','');
 QuarantineFile('C:\WINDOWS\system32\740e4247.exe','');
 QuarantineFile('C:\WINDOWS\apppatch\tkvssrx.dat','');
 QuarantineFile('C:\Program Files\Internet Explorer\setupapi.dll','');
 QuarantineFile('C:\WINDOWS\system32\drivers\kflqpn.sys','');
 DeleteFile('C:\WINDOWS\system32\drivers\kflqpn.sys');
 DeleteFile('C:\Program Files\Internet Explorer\setupapi.dll');
 DeleteFile('C:\WINDOWS\apppatch\tkvssrx.dat');
 DeleteFile('C:\WINDOWS\system32\740e4247.exe');
 DeleteFile('C:\WINDOWS\system32\XP-D41D8CD9.EXE ');
 DeleteFile('C:\Documents and Settings\Сергей\Главное меню\Программы\Автозагрузка\igfxtray.exe');
 DeleteFile('H:\slrmgr.exe');
 DeleteFile('H:\tnjh.exe');
 DeleteFile('I:\vtcgwa.pif');
 DeleteFile('D:\xdhpg.exe');
 DeleteFile('H:\ikohbg.exe');
 DeleteFile('H:\cuadlv.pif');
 DeleteFile('E:\ncuu.pif');
 DeleteFile('C:\jisp.exe');
 DeleteFile('H:\ajtuam.exe');
 DeleteFile('C:\mwpyc.exe');
 DeleteFileMask('C:\WINDOWS\Temp', '*.exe', true);
 RegKeyIntParamWrite('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
 RegKeyDel('HKLM', 'software\microsoft\shared tools\msconfig\startupreg\XP-D41D8CD9');
 RegKeyDel('HKLM', 'software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Сергей^Главное меню^Программы^Автозагрузка^igfxtray.exe');
 BC_ImportAll;
ExecuteSysClean;
 BC_DeleteFile('C:\WINDOWS\system32\drivers\kflqpn.sys');
 BC_DeleteSvc('amsint32');
BC_Activate;
RebootWindows(true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"="C:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"D:\\Program Files\\uTorrent\\uTorrent.exe"="D:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:ipsec"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:µTorrent"
"D:\\PROGRA~1\\THEKMP~1\\KMPlayer.exe"="D:\\PROGRA~1\\THEKMP~1\\KMPlayer.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe:*:Enabled:ipsec"
"D:\\Program Files\\AIMP2\\AIMP2.exe"="D:\\Program Files\\AIMP2\\AIMP2.exe:*:Enabled:ipsec"
"D:\\Program Files\\WinRAR\\WinRAR.exe"="D:\\Program Files\\WinRAR\\WinRAR.exe:*:Enabled:ipsec"
"C:\\Program Files\\Avant Browser\\avant.exe"="C:\\Program Files\\Avant Browser\\avant.exe:*:Enabled:ipsec"
"C:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\WINWORD.EXE:*:Enabled:ipsec"
"D:\\Program Files\\Notepad++\\notepad++.exe"="D:\\Program Files\\Notepad++\\notepad++.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\NOTEPAD.EXE"="C:\\WINDOWS\\system32\\NOTEPAD.EXE:*:Enabled:ipsec"
"D:\\Program Files\\Internet Download Manager\\IDMan.exe"="D:\\Program Files\\Internet Download Manager\\IDMan.exe:*:Enabled:ipsec"
"C:\\Program Files\\Unlocker\\Unlocker.exe"="C:\\Program Files\\Unlocker\\Unlocker.exe:*:Enabled:ipsec"
"C:\\Program Files\\Total Commander XP\\TOTALCMD.EXE"="C:\\Program Files\\Total Commander XP\\TOTALCMD.EXE:*:Enabled:ipsec"
"D:\\Program Files\\QIP Infium\\infium.exe"="D:\\Program Files\\QIP Infium\\infium.exe:*:Enabled:ipsec"
"C:\\Program Files\\Splan70\\Splan70.exe"="C:\\Program Files\\Splan70\\Splan70.exe:*:Enabled:ipsec"
"C:\\Program Files\\Globe Visibility Connection Manager\\Globe Visibility Connection Manager.exe"="C:\\Program Files\\Globe Visibility Connection Manager\\Globe Visibility Connection Manager.exe:*:Enabled:ipsec"