tyol.exe, zcfh.exe, gphboo.exe, djjqs.exe

Восстановление системы: включено

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 QuarantineFile('C:\WINDOWS\system32\explorer.exe','');
 QuarantineFile('C:\Documents and Settings\Admin.JGOOSE\Application Data\zcfh.exe','');
 QuarantineFile('C:\System Volume Information\_restore{A13E8959-CB37-49C9-8541-BF1065EB0E4E}\RP213\A0054084.exe','');
 QuarantineFile('C:\Documents and Settings\Admin.JGOOSE\Application Data\gphboo.exe','');
 DeleteFile('C:\Documents and Settings\Admin.JGOOSE\Application Data\gphboo.exe');
 DeleteFile('C:\Documents and Settings\Admin.JGOOSE\Application Data\zcfh.exe');
 DeleteFile('C:\System Volume Information\_restore{A13E8959-CB37-49C9-8541-BF1065EB0E4E}\RP213\A0054084.exe');
 DeleteFile('C:\WINDOWS\system32\explorer.exe');
 ExecuteRepair(16);
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

:Processes
explorer.exe

:Services

:Files
C:\WINDOWS\2781549.exe
C:\WINDOWS\0327.exe
C:\WINDOWS\044015.exe
C:\WINDOWS\4955177.exe
:Reg

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

begin
ExecuteRepair(11);
RebootWindows(true);
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
SetAVZPMStatus(True);
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RebootWindows(true);
end.