Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91910 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Virus problem


  • This topic is locked This topic is locked
63 replies to this topic

#31 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 06:57 AM

That bad boy has to be coming from somewhere.


Click HERE to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

    Advertisements

Register to Remove


#32 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 05:25 PM

* DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found :)" ________________________________________________ 1,115 items found: 1,115 files, 0 directories. Total of file sizes: 210,062,663 bytes 200.33 M Administrator Account = True --------------------End log--------------------- There was nothing listed in the lower pane.

Edited by Prolatariat_, 09 November 2005 - 05:26 PM.


#33 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 05:36 PM

  • Download FindIt NT-2K-XP.
  • Unzip the contents of FindIt NT-2K-XP.zip to a convenient location.
  • Navigate to the FindIt NT-2K-XP directory.
  • Double-click on FindNarrator.bat and wait for it to run.
  • It should open a Notepad window with the FindVX2 log.
  • Post the contents of FindNarrator.txt into your next post.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#34 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 05:36 PM

Ewido just came up with a message that it had picked up a virus again (the same one it previously picked up): msconfig32.exe C:\WINDOWS\system32 Infection: Backdoor.Codbot.at

#35 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 05:49 PM

4. To delete the value from the registry Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document, "How to make a backup of the Windows registry," for instructions. Click Start > Run. Type regedit Then click OK. Navigate to the subkeys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Network\[RANDOM FILE NAME] In the right pane, delete the value: "[DEFAULT]" = "Service" Navigate to and delete the registry subkeys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DHCP Client HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP_CLIENT HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP Client Exit the Registry Editor.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#36 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 06:05 PM

---------------- FindNarrator NT-2K-XP ---------------- Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ***** Operating System ***** Microsoft Windows XP Home Edition 5.1 Service Pack 1 (Build 2600) ********* Date/Time ******** Thursday, November 10, 2005 (11/10/2005) 12:51 PM, New Zealand Standard Time *********** Path *********** FindNarrator.bat is running from: C:\Documents and Settings\Owner\Desktop\FindIt NT-2K-XP\FindIt NT-2K-XP ---------------- Strings.exe Qoologic Results ---------------- ---------------- Strings.exe Aspack Results ---------------- ---------------- Active Setup Installed Components ---------------- ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{02f78298-8af6-495c-9ecb-b6ae68678186} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{839117ee-2132-4bae-a56a-42b50204c9b9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} ---------------- Context Menu Handlers ---------------- REGEDIT4 [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido] @="{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files] @="{750fdf0e-2a26-11d1-a3ea-080036587f03}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With] @="{09799AFB-AD67-11d1-ABCD-00C04FC30936}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu] @="{A470F8CF-A1E8-4f65-8335-227475AA5C46}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR] @="{B41DB860-8EE4-11D2-9906-E49FADC173CA}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}] @="Start Menu Pin" ---------------- Run Key ---------------- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Hcontrol"="C:\\WINDOWS\\ATK0100\\Hcontrol.exe" "AGRSMMSG"="AGRSMMSG.exe" "SoundMan"="SOUNDMAN.EXE" "ASUS Live Update"="C:\\Program Files\\ASUS\\ASUS Live Update\\ALU.exe" "Power_Gear"="C:\\Progra~1\\ASUS\\Power4 Gear\\BatteryLife.exe 1" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "SiS Tray"="C:\\WINDOWS\\System32\\sistray.EXE" "SiS KHooker"="C:\\WINDOWS\\System32\\khooker.exe" "pccguide.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\pccguide.exe\"" "PCCClient.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\PCCClient.exe\"" "Pop3trap.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\Pop3trap.exe\"" "EPSON Stylus C45 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I3T1.EXE /P23 \"EPSON Stylus C45 Series\" /O6 \"USB001\" /M \"Stylus C45\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" ---------------- FindNarrator NT-2K-XP ---------------- 

#37 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 06:30 PM

Nothing there. Run that registry fix I posted and see if those entries are there.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#38 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 06:40 PM

I found 4 of the 6 entries, but havn't deleted them yet: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msdirectx HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp

#39 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 06:51 PM

Right click on each of them ( msdirectx and all the Dhcp) and use Export each to the desktop.

Now delete all 4 ( msdirectx and all the Dhcp).

Exit the registry.

Open C:\windows\System32\msdirectx <--Delete this file if listed.
Note: If you can't delete it use Killbox.


Download Pocket Killbox version 2.0.0.175
http://www.atribune....ads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Then double-click on the killbox.exe program.


Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled Delete on reboot.

Do not close killbox, and open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.


When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.



C:\windows\System32\msdirectx


Return to Killbox, go to the File menu and select Paste from Clipboard.


Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#40 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 07:07 PM

This one would not delete: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP It gave an error message saying "Cannot delete LEGACY_DHCP: error while deleting key" Do I delete the exported files from the desktop too? I looked for this --> C:\windows\System32\msdirectx , but there was only a file called "DirectX" in System32.

    Advertisements

Register to Remove


#41 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 07:18 PM

[quote name='Prolatariat_' date='Nov 9 2005, 07:07 PM' post='227843']
This one would not delete:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP

It gave an error message saying "Cannot delete LEGACY_DHCP: error while deleting key"
Lets leave that one then.

Do I delete the exported files from the desktop too? Not yet. I'd make sure everything works.


I looked for this --> C:\windows\System32\msdirectx , but there was only a file called "DirectX" in System32.
DirectX is a legit file. Leave it.

Give it awhile and let me know how it goes.

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#42 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 08:18 PM

Well things appeared to be running well. Media Player is working without freezing, I can disconnect/reconnect without a problem, it's shutting down normally. Although, Add/Remove programs doesn't open. But once again a virus is picked up :( PC-cillin detected this again: C:\WINDOWS\System32\msdirectx.sys TROJ_ROOTKIT.H Can't be cleaned, was quarantined.

#43 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 08:27 PM

Lets try this tool. rookit infections are very bad. they try to steal passwords, account numbers, etc.
http://www.microsoft...ve/default.mspx

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#44 Prolatariat_

Prolatariat_

    Authentic Member

  • Authentic Member
  • PipPip
  • 32 posts

Posted 09 November 2005 - 09:03 PM

I use internet banking a lot so I can do without that type of virus... MRT Log: --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.2, March 2005 Started On Thu Apr 07 10:54:52 2005 Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Apr 07 10:55:15 2005 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.10, November 2005 Started On Thu Nov 10 15:46:10 2005 Quick Scan Results: ---------------- Found virus: Backdoor:Win32/Sdbot!40D5 in file C:\WINDOWS\System32\csrssa.exe Quick Scan Removal Results ---------------- Terminating process with pid 2448 Operation succeeded ! Deleting registry value HKLM\SOFTWARE\Microsoft\OLE, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Terminating process with pid 2448 Operation had previously completed. Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Terminating process with pid 2448 Operation had previously completed. Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Writing in file C:\WINDOWS\system32\drivers\etc\hosts Operation succeeded ! Deleting file C:\WINDOWS\System32\csrssa.exe Operation succeeded ! Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Results Summary: ---------------- Found Backdoor:Win32/Sdbot!40D5 and Removed!

#45 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,172 posts

Posted 09 November 2005 - 09:20 PM

Now lets see how it goes :thumbup:

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users