klpclst.dat Trojan.Carberp.30

 Procedure SysFileRecoverFromDistrib (Path, Name : string);
begin
 if MessageDLG('Для замены повреждённого системного файла ' + Name + ', который находится в папке ' + Path + ', вставьте дистрибутив Windows в CD\DVD-привод и нажмите "Да". Если же у вас нет дистрибутива или Вы хотите выполнить замену самостоятельно, нажмите "Нет"', mtConfirmation, mbYes+mbNo, 0) = 6 then
  begin   
    ExecuteFile('sfc /scannow', '', 1, 0, true);
    AddToLog('Пользователь выполнил "sfc /scannow"');
  end
 else
    AddToLog('Пользователь выбрал самостоятельный способ замены.');
end;

Procedure CompleteFix(Path, Name : string);
begin
   RenameFile('%windir%\system32\' + Name, '%windir%\system32\' + Name + '.bak');
   CopyFile(Path + Name, '%windir%\system32\' + Name);
   DeleteFile('%windir%\system32\' + Name + '.bak');
end;

Procedure SysFileRecoverFromBackup(Path, Name : string);
begin
  AddToLog('Файл ' + '%windir%\system32\' + Name + ' -> MD5 = ' + CalkFileMD5('%windir%\system32\' + Name));
  if (FileExists('%windir%\system32\dllcache\' + Name) and FileExists('%windir%\ServicePackFiles\i386\dllcache\' + Name)) and ((CalkFileMD5('%windir%\system32\dllcache\' + Name) <> CalkFileMD5('%windir%\ServicePackFiles\i386\dllcache\' + Name))) then
   begin
     AddToLog('Замена из ServicePackFiles\i386\dllcache и dllcache не произведена - MD5 у файлов различные. Запрошен дистрибутив.');
     AddToLog('Файл ' + '%windir%\system32\dllcache\' + Name + ' -> MD5 = ' + CalkFileMD5('%windir%\system32\dllcache\' + Name));
     AddToLog('Файл ' + '%windir%\ServicePackFiles\i386\dllcache\' + Name + ' -> MD5 = ' + CalkFileMD5('%windir%\ServicePackFiles\i386\dllcache\' + Name));
     SysFileRecoverFromDistrib(Path, Name);
   end
  else if FileExists('%windir%\system32\dllcache\' + Name) then
   begin
    AddToLog('Файл ' + '%windir%\system32\dllcache\' + Name + ' -> MD5 = ' + CalkFileMD5('%windir%\system32\dllcache\' + Name));
    if (CalkFileMD5('%windir%\system32\dllcache\' + Name) <> CalkFileMD5(Path + Name)) then
      begin
        CompleteFix('%windir%\system32\dllcache\', Name); 
        AddToLog('Замена ' + Name + ' успешно произведена из \system32\dllcache\');
      end
    else if FileExists('%windir%\ServicePackFiles\i386\dllcache\' + Name) then
     begin
       AddToLog('Файл ' + '%windir%\ServicePackFiles\i386\dllcache\' + Name + ' -> MD5 = ' + CalkFileMD5('%windir%\ServicePackFiles\i386\dllcache\' + Name));
       if (CalkFileMD5('%windir%\ServicePackFiles\i386\dllcache\' + Name) <> CalkFileMD5(Path + Name)) then
        begin
          CompleteFix('%windir%\ServicePackFiles\i386\dllcache\', Name);
          AddToLog('Замена ' + Name + ' успешно произведена из \ServicePackFiles\i386\');
        end
     end
   end;
 if (not FileExists('%windir%\system32\dllcache\' + Name)) and (not FileExists('%windir%\ServicePackFiles\i386\dllcache\' + Name)) then 
  begin
    AddToLog('Замена из ServicePackFiles\i386\dllcache и dllcache не произведена - нет файлов. Запрошен дистрибутив.');
    SysFileRecoverFromDistrib(Path, Name);
  end;
 SaveLog('SafeZone.log');
end;

var SourcePath : String;
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 ClearLog;
 QuarantineFile('%windir%\system32\drivers\sfc.sys','');  QuarantineFileF('C:\GoK7lfK4qmoNUFh', '*.*', false, '', 0, 0);
 QuarantineFileF('C:\Documents and Settings\Admin\Application Data\GoK7lfK4qmoNUFh', '*.*', false, '', 0, 0);
 QuarantineFileF('C:\Documents and Settings\All Users\Application Data\FLEXnet', '*.*', false, '', 0, 0);
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\WRiyImiLA.dll','');
 QuarantineFile('ф?‘|x?‹.exe','');
 QuarantineFile('C:\WINDOWS\system32\sdra64.exe','');
 QuarantineFile('C:\WINDOWS\system32\svshost.dll','');
 QuarantineFile('C:\Program Files\plugin.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\5nNrztfAlwk.exe','');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\5nNrztfAlwk.exe');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\WRiyImiLA.dll');
 DeleteFile('C:\Program Files\plugin.exe');
 DeleteFile('ф?‘|x?‹.exe.');
 DeleteFile('C:\WINDOWS\system32\svshost.dll');
 DeleteFile('C:\WINDOWS\system32\sdra64.exe');
 DeleteFile('C:\plg.txt');
 DelCLSID('D7FFD784-5276-42D1-887B-00267870A4C7');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','userinit');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','userinit');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad','SysRun');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Generic Host for Win32 Services');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','plugin');
 DeleteFileMask('C:\GoK7lfK4qmoNUFh', '*.*', true);
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\GoK7lfK4qmoNUFh', '*.*', true);
 DeleteFileMask('C:\Documents and Settings\All Users\Application Data\FLEXnet', '*.*', true);
 DeleteDirectory('C:\GoK7lfK4qmoNUFh');
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\GoK7lfK4qmoNUFh');
 DeleteDirectory('C:\Documents and Settings\All Users\Application Data\FLEXnet');
 DeleteFile('%windir%\system32\drivers\sfc.sys');
 SysFileRecoverFromBackup('%windir%\system32\', 'sfcfiles.dll'); 
BC_ImportAll;
ExecuteSysClean;
 BC_DeleteSvc('sfc');
BC_Activate;
 ExecuteRepair(6);
RegKeyIntParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1);
 ExecuteRepair(14);
RebootWindows(true);
end.

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\Documents and Settings\All Users\Application Data\WRiyImiLA.dll');
 DelSPIByFileName('C:\Documents and Settings\All Users\Application Data\WRiyImiLA.dll', false);
 AutoFixSPI;
RebootWindows(false);
end.