:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72988A9F-6FCA-4FE9-9692-EA4070DBBF8A}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"s6CkuG2XDC"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"srvproczman"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae9aded8-3fb4-11dd-aa52-001d92a5d8f7}]

:services
WinSvc

:files
C:\Program Files\Winsudate\gibsvc.exe
C:\WINDOWS\system32\Audiode.dll
C:\DOCUME~1\Ju\LOCALS~1\Temp\9llCJ5amiU.exe
C:\WINDOWS\system32\pkrylipa.exe
C:\sivjdlj.exe
C:\sdgm.exe
C:\beyeij.exe
C:\Documents and Settings\Ju\Application Data\EoRezo

:commands
[emptytemp]
[createrestorepoint]