VIRY.CZ

Přeji všem hezký den ...
Prosím o kontrolu logu. Mám neustále problémy s Trojským koněm Downloader.Generic10.UOB
Nemohu se ho zbavit.
Problém nastal tím, že přestali účinkovat aktualizace NOD32 ... Nakonec odinstalováno, ale stejně nelze NOD32 odinstalovat úplně, ale to začalo až po spuštění COMBOFIXu.
Nyní u AVG se každý den znovu a znovu PC léčí a pokaždé se najde Trojan.


ComboFix 10-09-25.01 - 25.09.2010 20:22:07.1.2 - x86
Systém Microsoft Windows XP Professional
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Data aplikací\page
c:\documents and settings\All Users\Data aplikací\page\page.ico
c:\documents and settings\All Users\Data aplikací\page\page.URL
c:\documents and settings\Data aplikací\Desktopicon
c:\documents and settings\Local Settings\Temporary Internet Files\PMH1A67.tmp
((((((((((((((((((((((((( Soubory vytvořené od 2010-08-25 do 2010-09-25 )))))))))))))))))))))))))))))))
.

2010-09-22 11:38 . 2010-09-22 11:38 -------- d-----w- C:\$AVG
2010-09-21 19:41 . 2009-08-24 20:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-09-21 19:35 . 2010-09-21 19:35 -------- d-----w- C:\totalcmd
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\UC.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\RAR.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\PKZIP.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\PKUNZIP.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\NOCLOSE.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\LHA.PIF
2010-09-21 19:35 . 2009-09-24 05:50 545 ----a-w- c:\windows\ARJ.PIF
2010-09-21 18:17 . 2010-09-21 18:17 -------- d-----w- c:\documents and settings\All Users\Uniblue
2010-09-21 17:57 . 2010-09-21 17:57 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-09-21 17:02 . 2010-09-21 17:02 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-21 17:02 . 2010-09-21 17:57 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-21 17:02 . 2010-09-21 17:57 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-21 17:02 . 2010-09-21 17:57 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-21 17:02 . 2010-09-25 11:12 -------- d-----w- c:\windows\system32\drivers\Avg
2010-09-21 17:02 . 2010-09-21 17:02 -------- d-----w- c:\program files\AVG
2010-09-21 16:03 . 2010-09-21 16:03 23 --sha-w- c:\windows\system32\edacded0.dat
2010-09-21 11:34 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-21 11:34 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-21 11:34 . 2010-09-21 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-28 13:57 . 2010-08-28 13:57 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-28 13:57 . 2010-08-28 13:57 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-08-28 13:57 . 2010-08-28 13:57 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-08-28 13:57 . 2010-08-28 13:58 -------- d-----w- c:\program files\NVIDIA Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-25 17:21 . 2009-02-04 21:44 -------- d-----w- c:\program files\HP
2010-09-21 18:02 . 2009-07-14 20:30 -------- d-----w- c:\program files\Ashampoo
2010-09-17 17:36 . 2009-01-12 12:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-02 15:26 . 2010-02-27 21:12 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-17 13:17 . 2003-04-16 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 01:05 . 2003-04-16 12:00 90546 ----a-w- c:\windows\system32\perfc005.dat
2010-08-13 01:05 . 2003-04-16 12:00 458370 ----a-w- c:\windows\system32\perfh005.dat
2010-07-28 22:19 . 2010-07-28 22:19 -------- d-----w- c:\program files\Common Files\Java
2010-07-28 22:18 . 2010-01-26 20:07 -------- d-----w- c:\program files\Java
2010-07-22 15:46 . 2003-04-16 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-17 03:00 . 2010-04-18 18:27 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-06-30 12:33 . 2003-04-16 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-05-06 07:29 . 2010-05-06 07:29 848 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-18 11:58 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 12:04 1664256 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-18 333192]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Petr Mann\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-01-18 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-04-26 14370816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-21 2065760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr Mann\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-14 110592]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-21 17:57 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [21.9.2010 19:02 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [21.9.2010 19:02 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [21.9.2010 19:02 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [21.9.2010 19:57 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [21.9.2010 19:57 308136]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [31.3.2010 20:28 135664]
S3 AHZE;AHZE;c:\docume~1\PETRMA~1\LOCALS~1\Temp\AHZE.exe --> c:\docume~1\PETRMA~1\LOCALS~1\Temp\AHZE.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [21.9.2010 19:02 369920]
S3 DfSdkS;Defragmentation-Service;d:\data\Ashampoo WinOptimizer 6\DfSdkS.exe [21.9.2010 21:41 406016]
S3 esihdrv;esihdrv;\??\c:\docume~1\PETRMA~1\LOCALS~1\Temp\esihdrv.sys --> c:\docume~1\PETRMA~1\LOCALS~1\Temp\esihdrv.sys [?]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 18:28]

2010-09-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 18:28]

2010-09-25 c:\windows\Tasks\User_Feed_Synchronization-{295B1BA2-35AD-4F0B-8581-20817581583D}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.seznam.cz/
IE: &Přelož do češtiny - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5034
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Hlede&j v ČR - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5033
IE: Hledej v &encyklopedii - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5108
IE: Hledej ve &světě - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5035
IE: Hledej ve &zboží - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5107
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: mojebanka.cz\
Trusted Zone: mojebanka.cz\
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-25 20:29
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
Celkový čas: 2010-09-25 20:31:09
ComboFix-quarantined-files.txt 2010-09-25 18:31

Před spuštěním: Volných bajtů: 27 175 944 192
Po spuštění: Volných bajtů: 27 295 313 920

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - EDFF39C6DDFD8F06950C339F0668695D

Ještě dočistíme. Pokud nemáte ComboFix na ploše, přesunte ho tam. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Folder::
c:\program files\AskBarDis

Collect::
c:\docume~1\PETRMA~1\LOCALS~1\Temp\AHZE.exe

Driver::
AHZE

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pustte. CF se spustí a vykoná příkazy ze skriptu.

ComboFix 10-09-25.07 - 26.09.2010 19:23:23.1.2 - x86
Systém Microsoft Windows XP Professional Spuštěný z: c:\documents and settings\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Petr Mann\Plocha\CFScript.txt.txt
AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Petr Mann\Data aplikací\Desktopicon
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\0118FC11
c:\program files\AskBarDis\bar\Cache\0118FEA1
c:\program files\AskBarDis\bar\Cache\01190112.bin
c:\program files\AskBarDis\bar\Cache\01190289.bin
c:\program files\AskBarDis\bar\Cache\011904EB.bin
c:\program files\AskBarDis\bar\Cache\01190690.bin
c:\program files\AskBarDis\bar\Cache\011907E8.bin
c:\program files\AskBarDis\bar\Cache\01190930.bin
c:\program files\AskBarDis\bar\Cache\01190A78.bin
c:\program files\AskBarDis\bar\Cache\01190BC1.bin
c:\program files\AskBarDis\bar\Cache\01190D09.bin
c:\program files\AskBarDis\bar\Cache\01190E41.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\PopSwatter\History\notallow
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe
C:\UCTO2010
c:\ucto2010\{OBNV}.BAT
c:\ucto2010\{OBNV}\UCTO2010.CAT
c:\ucto2010\{TISK}\ALISFAND.EXE
c:\ucto2010\{TISK}\CALLER.EXE
c:\ucto2010\{TISK}\CMDIALOG.VBX
c:\ucto2010\{TISK}\DISKSIZW.EXE
c:\ucto2010\{TISK}\DISKY.EXE
c:\ucto2010\{TISK}\ELPODPIS.EXE
c:\ucto2010\{TISK}\FAND2PDF.EXE
c:\ucto2010\{TISK}\FANDCLIP.EXE
c:\ucto2010\{TISK}\IEUCTO.EXE
c:\ucto2010\{TISK}\MSINET.OCX
c:\ucto2010\{TISK}\MSMAPI32.OCX
c:\ucto2010\{TISK}\MSVBVM60.DLL
c:\ucto2010\{TISK}\PDFTISK1.EXE
c:\ucto2010\{TISK}\PDFTISK2.EXE
c:\ucto2010\{TISK}\PDFTISK3.EXE
c:\ucto2010\{TISK}\REGISTER.EXE
c:\ucto2010\{TISK}\SETUPCP.EXE
c:\ucto2010\{TISK}\UCTOFONT.FON
c:\ucto2010\{TISK}\UCTOFT98.EXE
c:\ucto2010\{TISK}\UCTOFTP.EXE
c:\ucto2010\{TISK}\UCTOGRAF.EXE
c:\ucto2010\{TISK}\UCTOGRAF.INI
c:\ucto2010\{TISK}\UCTOLNK.EXE
c:\ucto2010\{TISK}\UEMAIL.EXE
c:\ucto2010\{TISK}\UEMAIL06.EXE
c:\ucto2010\{TISK}\UTISK01.EXE
c:\ucto2010\{TISK}\UTISK04.EXE
c:\ucto2010\{TISK}\UTISK98.EXE
c:\ucto2010\{TISK}\UTISK98.INI
c:\ucto2010\{TISK}\VBRUN300.DLL
c:\ucto2010\{TISK}\WINVERZE.EXE
c:\ucto2010\{WWWW}\komplet.exe
c:\ucto2010\CAT.BAT
c:\ucto2010\DELFILE.EXE
c:\ucto2010\DISKSIZE.EXE
c:\ucto2010\FAND.CFG
c:\ucto2010\FANDHTML.EXE
c:\ucto2010\FANDINST.EXE
c:\ucto2010\FANDT602.EXE
c:\ucto2010\FILESIZE.EXE
c:\ucto2010\FNDFILES.EXE
c:\ucto2010\IMPORT.TRO
c:\ucto2010\ISSHARE.EXE
c:\ucto2010\MAKEDIR.BAT
c:\ucto2010\MODUL01.TRO
c:\ucto2010\MODUL02.TRO
c:\ucto2010\MODUL03.TRO
c:\ucto2010\MODUL04.TRO
c:\ucto2010\MODUL05.TRO
c:\ucto2010\MODUL06.TRO
c:\ucto2010\MODUL07.TRO
c:\ucto2010\MODUL08.TRO
c:\ucto2010\MODUL09.TRO
c:\ucto2010\MODUL97.TRO
c:\ucto2010\MODUL98.TRO
c:\ucto2010\MODUL99.TRO
c:\ucto2010\NUMKB.EXE
c:\ucto2010\NUMKB3.EXE
c:\ucto2010\PGM.CAT
c:\ucto2010\PGM.RDB
c:\ucto2010\RENFILES.BAT
c:\ucto2010\RO.EXE
c:\ucto2010\SEARCHX.EXE
c:\ucto2010\SEST01.TRO
c:\ucto2010\SEST02.TRO
c:\ucto2010\SEST03.TRO
c:\ucto2010\SEST04.TRO
c:\ucto2010\SEST05.TRO
c:\ucto2010\SEST06.TRO
c:\ucto2010\SEST07.TRO
c:\ucto2010\SEST08.TRO
c:\ucto2010\SEST09.TRO
c:\ucto2010\SESTAVY.CAT
c:\ucto2010\SESTAVY.RDB
c:\ucto2010\SETDATE.EXE
c:\ucto2010\SETFILES.EXE
c:\ucto2010\SPEC01.TRO
c:\ucto2010\SPEC02.TRO
c:\ucto2010\SPEC03.TRO
c:\ucto2010\SPEC04.TRO
c:\ucto2010\SPEC05.TRO
c:\ucto2010\SPEC06.TRO
c:\ucto2010\SPEC07.TRO
c:\ucto2010\SUBDIR.EXE
c:\ucto2010\SUDLICH.EXE
c:\ucto2010\TTT.CAT
c:\ucto2010\TTT.RDB
c:\ucto2010\TXTNARTF.EXE
c:\ucto2010\U.BAT
c:\ucto2010\UCTO2010.CAT
c:\ucto2010\UCTO2010.ICO
c:\ucto2010\UCTO2010.RDB
c:\ucto2010\UCTOINFO.TRO
c:\ucto2010\UFAND.EXE
c:\ucto2010\UK.BAT
c:\ucto2010\UPG.TRO
c:\ucto2010\UPG01.TRO
c:\ucto2010\UPG02.TRO
c:\ucto2010\UPG03.TRO
c:\ucto2010\UPG04.TRO
c:\ucto2010\UPG05.TRO
c:\ucto2010\UPG06.TRO
c:\ucto2010\UPG07.TRO
c:\ucto2010\UPG08.TRO
c:\ucto2010\UPG09.TRO
c:\ucto2010\UPG97.TRO
c:\ucto2010\UPG99.TRO
c:\ucto2010\VYBERTXT.EXE
c:\ucto2010\ZASTUPCE.CAT
c:\ucto2010\ZASTUPCE.INI
c:\ucto2010\ZASTUPCE.RDB
c:\ucto2010\ZZZ.BAT

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AHZE
-------\Service_AHZE


((((((((((((((((((((((((( Soubory vytvořené od 2010-08-26 do 2010-09-26 )))))))))))))))))))))))))))))))
.

2010-09-26 15:17 . 2010-09-26 15:17 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-09-26 14:52 . 2010-09-26 14:52 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-09-26 14:52 . 2010-09-26 15:17 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-09-26 14:52 . 2010-09-26 15:17 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-09-26 14:52 . 2010-09-26 15:17 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-09-26 14:52 . 2010-09-26 15:03 -------- d-----w- c:\windows\system32\drivers\Avg
2010-09-26 10:32 . 2010-09-26 10:32 -------- d-----w- c:\program files\Conduit
2010-09-26 10:32 . 2010-09-26 10:32 -------- d-----w- c:\program files\MyAshampoo
2010-09-26 10:32 . 2009-08-24 20:08 28160 ----a-w- c:\windows\system32\DfSdkBt.exe
2010-09-25 21:40 . 2010-09-25 21:40 -------- d-----w- c:\program files\ESET
2010-09-25 19:53 . 2010-09-25 19:53 -------- d-----w- c:\windows\system32\wbem\Repository
2010-09-25 19:52 . 2010-09-25 19:52 -------- d-----w- c:\program files\ICQ6Toolbar
2010-09-25 19:52 . 2010-09-25 19:52 -------- d-----w- C:\mirror
2010-09-22 11:38 . 2010-09-22 11:38 -------- d-----w- C:\$AVG
2010-09-21 19:35 . 2010-09-25 19:02 -------- d-----w- C:\totalcmd
2010-09-21 17:02 . 2010-09-21 17:02 12464 ----a-w- c:\windows\system32\avgrsstx(3).dll
2010-09-21 17:02 . 2010-09-25 18:44 -------- d-----w- c:\windows\system32\drivers\Avg(2)
2010-09-21 17:02 . 2010-09-21 17:02 -------- d-----w- c:\program files\AVG
2010-09-21 16:03 . 2010-09-21 16:03 23 --sha-w- c:\windows\system32\edacded0.dat
2010-08-28 13:57 . 2010-08-28 13:57 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-08-28 13:57 . 2010-08-28 13:57 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-08-28 13:57 . 2010-08-28 13:57 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-08-28 13:57 . 2010-08-28 13:58 -------- d-----w- c:\program files\NVIDIA Corporation

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-26 10:31 . 2009-07-14 20:30 -------- d-----w- c:\program files\Ashampoo
2010-09-25 17:21 . 2009-02-04 21:44 -------- d-----w- c:\program files\HP
2010-09-17 17:36 . 2009-01-12 12:54 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-02 15:26 . 2010-02-27 21:12 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-17 13:17 . 2003-04-16 12:00 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-13 01:05 . 2003-04-16 12:00 90546 ----a-w- c:\windows\system32\perfc005.dat
2010-08-13 01:05 . 2003-04-16 12:00 458370 ----a-w- c:\windows\system32\perfh005.dat
2010-07-28 22:19 . 2010-07-28 22:19 -------- d-----w- c:\program files\Common Files\Java
2010-07-28 22:18 . 2010-01-26 20:07 -------- d-----w- c:\program files\Java
2010-07-22 15:46 . 2003-04-16 12:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 06:19 . 2008-05-05 05:25 5632 ----a-w- c:\windows\system32\xpsp4res.dll
2010-07-17 03:00 . 2010-04-18 18:27 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-09 14:24 . 2010-07-09 14:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 14:24 . 2010-07-09 14:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 14:24 . 2010-07-09 14:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 14:24 . 2010-07-09 14:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 14:24 . 2010-07-09 14:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 14:24 . 2010-07-09 14:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-06-30 12:33 . 2003-04-16 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-05-06 07:29 . 2010-05-06 07:29 848 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "c:\program files\MyAshampoo\tbMyAs.dll" [2009-12-31 2349080]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]
2009-12-31 09:53 2349080 ----a-w- c:\program files\MyAshampoo\tbMyAs.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 12:04 1664256 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}"= "c:\program files\MyAshampoo\tbMyAs.dll" [2009-12-31 2349080]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}"= "c:\program files\MyAshampoo\tbMyAs.dll" [2009-12-31 2349080]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Petr Mann\Local Settings\Data aplikací\Google\Update\GoogleUpdate.exe" [2009-01-18 133104]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-03-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2005-04-26 14370816]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-07 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-09-26 2065760]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Petr Mann\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Věýezy obrazovky a spuçtŘnˇ aplikace OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-1-14 110592]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-09-26 15:17 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [26.9.2010 16:52 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [26.9.2010 16:52 216400]
R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [26.9.2010 16:52 243024]
R2 avg9emc;AVG E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [26.9.2010 17:17 921952]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [26.9.2010 17:17 308136]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys --> c:\windows\system32\DRIVERS\epfwtdir.sys [?]
S2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" --> c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [?]
S2 gupdate;Služba Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [31.3.2010 20:28 135664]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [17.9.2010 19:36 246520]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [26.9.2010 16:52 369920]
S3 DfSdkS;Defragmentation-Service;c:\program files\Ashampoo\Ashampoo WinOptimizer 6\DfSdkS.exe [26.9.2010 12:32 406016]
.
Obsah adresáře 'Naplánované úlohy'

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 18:28]

2010-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-31 18:28]

2010-09-26 c:\windows\Tasks\User_Feed_Synchronization-{295B1BA2-35AD-4F0B-8581-20817581583D}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE: &Přelož do češtiny - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5034
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Hlede&j v ČR - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5033
IE: Hledej v &encyklopedii - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5108
IE: Hledej ve &světě - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5035
IE: Hledej ve &zboží - d:\microsoft word\Seznam\Listicka\Toolbar.dll/5107
IE: WikiKomentáře Google... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: mojebanka.cz\*
Trusted Zone: mojebanka.cz\*
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

WebBrowser-{FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - (no file)
HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
HKCU-Run-ICQ - d:\data\ICQ7.2\ICQ.exe
HKLM-Run-egui - c:\program files\ESET\ESET NOD32 Antivirus\egui.exe
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe
AddRemove-SmartMaps Router - Cyklomapa ČR_is1 - d:\data\Cyklopruvodce\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-26 19:29
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'explorer.exe'(3016)
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\AVG\AVG9\avgam.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\documents and settings\Petr Mann\Local Settings\Data aplikací\Google\Update\1.2.183.29\GoogleCrashHandler.exe
c:\windows\system32\CNAB4RPK.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Celkový čas: 2010-09-26 19:31:43 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-09-26 17:31
ComboFix2.txt 2010-09-25 18:31

Před spuštěním: Volných bajtů: 24 359 329 792
Po spuštění: Volných bajtů: 24 247 914 496

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 95933F015D6A75177A7F91DF6348BC02

PROSÍM o radu u předchozího logu ... Nelze mi odinstalovat NOD32, takže COMBOFIX byl spuštěn přez něj ...
Děkuji Vám ...

Log již vypadá čistý. Jeden z antivirů musí ven, jinak by mohlo docházet k sw kolizi. Pokud nejde NOD odinstalovat, zkuste NOD znovu nainstalovat a pak korektně odinstalovat.

Děkuji za pomoc v neděli večer ...
Díky moc.

Rádo se stalo!