Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

dnschanger still in action after changing to open dns


  • Please log in to reply
20 replies to this topic

#1 Jessica211

Jessica211

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 07 January 2009 - 09:02 PM

Yesterday I noticed my computer internet browsers acting funny - directing me to false websites. I did a little research on my mobile and discovered the symptoms were likely a dnschanger. I switched to an open dns number and it seemed to fix the problem last night (although I knew it was probably a bandaid approach). Tonight I turned on the computer and I have the same problem - even though my computer indicates it is operating on open dns numbers.

McAfee scan showed 9 trojans, but deleted them yesterday.

Not sure what my next move should be. Please help!!!!!!

BC AdBot (Login to Remove)

 


#2 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 08 January 2009 - 10:01 PM

PLEASE!!!!

I need help!

I have run three different anti virus/malware scans and deletes and changed my DNS to open DNS and still have the problem.

Please help!

#3 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 08 January 2009 - 10:26 PM

Hello Jessica211 and welcome to BC!! :thumbsup:

DNSChanger can usually be removed or fixed using Malwarebytes anti-malware. We will start off with that.

What Trojans did your McAfee find? That might help us a bit, please also include the filename and location of the path as well. A log may also be helpful :flowers:

Download and run MalwareBytes Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this link

Post back with the log once it's complete.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#4 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 10 January 2009 - 10:45 AM

Hi, thanks for helping me - my computer is driving me nuts. I ran the malwarebytes scanner a few days ago - that didn't work, the log is below. I also ran the super antispyware in safe mode since I saw that as a recommendation elsewhere. It deleted detected a lot of files, but I can't find that log anywhere now. That didn't work either. I am still operating on open dns and still getting bogus websites in my searches. My computer is also running extemely slow now. Thanks in advance for any help!

Malwarebytes' Anti-Malware 1.32
Database version: 1629
Windows 5.1.2600 Service Pack 3

1/7/2009 9:49:30 PM
mbam-log-2009-01-07 (21-49-30).txt

Scan type: Quick Scan
Objects scanned: 71099
Time elapsed: 28 minute(s), 12 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#5 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 10 January 2009 - 04:58 PM

Hello.

Sorry for the delay. I missed this topic because it got pushed back, sorry about that..

Try flushing your DNS and see if that helps.

How to flush your DNS Cache

Please open your command prompt. To do that follow the instructions below.
  • Go to Start>>Run>>In the open field type in "cmd" (without the quotes)
  • This will open the Command Prompt, a tutorial on opening the cmd can be found here
  • In the command prompt please type in "ipconfig /flushdns" (without the quotes)
    Note: Please note the space after the g of ipconfig and / of flushdns.
  • Now press enter and you should recieve a message saying something similar to "Successfully flushed the DNS cache"
  • Exit out Command Prompt by typing in "Exit" (without quotes)
How is your computer now?

If that still doesn't work, try running Winsockfix.

Download and Run WinsockFix
  • Download WinsockXPFix and save it to your desktop.
  • Double Click on Posted Image on your desktop.
  • Push the Posted Image button.
  • Allow your system to reboot afterwards.
Tell me how it goes.

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#6 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 19 January 2009 - 04:52 PM

Hi there. Sorry for my delay - I was away from this computer for awhile. So I took the two steps you suggested, but the searches are still showing up with bogus addresses. On the up side my computer is running much much faster! Ready for the next idea . . .

#7 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 19 January 2009 - 05:40 PM

Hello.

I think I understand you problem now. It seems to be related to this fairly new infection related to the sysaudio.sys. Do you get redirected when you search on google?

I need to confirm if it is that though. Please perform the following steps. First backup the registry because we are going to export a key so I can look at. If something goes wrong we have a backup in place to let us be safe when searching.

Backup Registry with ERUNT

This tool will create a complete backup of your registry. A backup is created to ensure we have backup so encase anything goes wrong we can deal with it. Do not delete these backups until we are finished.
  • Please download erunt-setup.exe to your desktop.
  • Double click erunt-setup.exe. Follow the prompts and allow ERUNT to be installed with the settings at default. If you do not want a Desktop icon, feel free to uncheck that. When asked if you want to create an ERUNT entry in the startup folder, answer Yes. You can delete the installation file after use.
  • Erunt will open when the installation is finished. Check all items to be backed up in the default location and click OK.
You can find a complete guide to using the program here:
http://www.larshederer.homepage.t-online.de/erunt/erunt.txt


How to Restore from the ERUNT Backup
Only restore from the backups if instructed to, or you need to do so. You need it if after doing something, your computer will only boot in Safe Mode and you are unable to contact us (or anyone else) for help by other means, or if your computer will not boot into Windows at all.

To restore if you can boot, navigate to C:\WINDOWS\erdnt, choose the folder with the most recent date, and double click ERDNT.EXE. Check all boxes in the restoration options.

To restore from the Recovery Console using the Windows CD:
  • Turn on your machine with the disk in the drive.
  • Type in the number of the Windows installation you want to repair (usually 1), then press Enter.
  • Type in the Administrator password (leave blank if you are unsure what it is or if you do not have one) and press Enter.
  • Type without quotes "cd erdnt" followed by Enter.
  • Type without quotes "dir" followed by Enter. This will list out the available folders, whose names are the date on which the backup was taken in (M)M-DD-YYYY format. Try the most recent dates first.
  • Type without quotes "cd **name of the folder**" followed by Enter.
  • Type without quotes "batch erdnt.con" followed by Enter.
  • Type without quotes "exit" followed by Enter.
  • Remove your CD from the drive and reboot your computer into the restored registry. If you still cannot boot, try again with an earlier restore date.

Create and Run batch script
  • Copy the following into a notepad (Start>Run>"notepad"). Do not copy the word "quote".

    @Echo off

    If exist "C:\looking.txt" Del /q /s "C:\looking.txt"
    reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32" >> C:\looking.txt
    Notepad C:\looking.txt

    Exit

    Del %0

  • Click File, then Save As... .
  • Click Desktop on the left.
  • Under the Save as type dropdown, select All Files.
  • In the box File Name, input peek.bat.
  • Hit OK.
When done properly, the icon should look like Posted Image for the .bat file.

Double click on peek.bat, and Black DOS window shall appear and then notepad will soon open. This is normal please do not panic. Once it's complete copy and paste the contents of notepad in your next reply.

Note: If you closed notepad accidentally, it can also be found at C:\looking.txt

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#8 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 19 January 2009 - 06:24 PM

Hi again! Yes, the problem does exist when looking at a google or a yahoo search. Here is what appeared in the notepad


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32
midimapper REG_SZ midimap.dll
msacm.imaadpcm REG_SZ imaadp32.acm
msacm.msadpcm REG_SZ msadp32.acm
msacm.msg711 REG_SZ msg711.acm
msacm.msgsm610 REG_SZ msgsm32.acm
msacm.trspch REG_SZ tssoft32.acm
vidc.cvid REG_SZ iccvid.dll
vidc.I420 REG_SZ msh263.drv
vidc.iv31 REG_SZ ir32_32.dll
vidc.iv32 REG_SZ ir32_32.dll
vidc.iyuv REG_SZ iyuv_32.dll
vidc.mrle REG_SZ msrle32.dll
vidc.msvc REG_SZ msvidc32.dll
vidc.uyvy REG_SZ msyuv.dll
vidc.yuy2 REG_SZ msyuv.dll
vidc.yvu9 REG_SZ tsbyuv.dll
vidc.yvyu REG_SZ msyuv.dll
wavemapper REG_SZ msacm32.drv
msacm.msg723 REG_SZ msg723.acm
vidc.M263 REG_SZ msh263.drv
vidc.M261 REG_SZ msh261.drv
msacm.msaudio1 REG_SZ msaud32.acm
msacm.sl_anet REG_SZ sl_anet.acm
msacm.l3acm REG_SZ l3codecx.acm
vidc.iv41 REG_SZ ir41_32.ax
msacm.iac2 REG_SZ iac25_32.ax
vidc.iv50 REG_SZ ir50_32.dll
wave REG_SZ wdmaud.drv
midi REG_SZ wdmaud.drv
mixer REG_SZ wdmaud.drv
vidc.LEAD REG_SZ LCODCCMP.DLL
aux REG_SZ wdmaud.sys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32\Terminal Server

#9 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 19 January 2009 - 07:06 PM

Hello.

I see it. Good job. :thumbsup:

Create and Run batch script
  • Copy the following into a notepad (Start>Run>"notepad"). Do not copy the word "quote".

    @Echo off

    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /v aux /d wdmaud.drv

    If Exist "C:\deletelog.txt" del "C:\deletelog.txt"
    For %%a in (
    C:\Windows\system32\wdmaud.sys
    C:\WINDOWS\system32\sysaudio.sys
    ) Do (
    del /q /s /f /a %%a >nul 2>&1
    if exist %%a echo.%%~a>>"C:\deletelog.txt"
    )
    if exist "C:\deletelog.txt" ( start notepad "C:\deletelog.txt"
    ) else echo.Deleted!
    Pause

    Exit

    Del %0

  • Click File, then Save As... .
  • Click Desktop on the left.
  • Under the Save as type dropdown, select All Files.
  • In the box File Name, input removal.bat.
  • Hit OK.
When done properly, the icon should look like Posted Image for the .bat file.

Double click on removal.bat, and Black DOS window shall appear and then you will see some message in that Black DOS window, please write that message down. Then after you have written the message down you will see a message saying "Press Any Key to Continue..." Please press any key to exit that Black DOS window. This is normal please do not panic. Reply back with the the message in that window in your next reply please.

After that please re-run peek.bat that you created in your last post after you have done the steps above.

Post back with:
-The Message in the Black DOS window
-Peek.bat notepad contents
(Located in C:\looking.txt)

How is your computer now? Is there still redirects?

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#10 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 19 January 2009 - 07:26 PM

Hi - I created the removal.bat file you suggested. When I double click the dos screen says "Vale aux exists, overwrite (Y/N)?"

Not sure what to do here - didn't see you reference that in your last response. I closed the file rather than guess what I was suppose to do.

Once I am clear on the correct step I will proceed.

Thanks

#11 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 19 January 2009 - 07:54 PM

Hello.

Sorry for the short delay.

In that case Just type in "Y"(without the "") please. Then continue with the next step.

With Regards,
Extremeboy

Edited by extremeboy, 19 January 2009 - 07:54 PM.

Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#12 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 19 January 2009 - 08:01 PM

OK - so the message in the black dos screen read:
The operation completed successfully
Deleted!

When I ran the peek.bat again no notepad opened the first time, but the second time I got this:

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32
midimapper REG_SZ midimap.dll
msacm.imaadpcm REG_SZ imaadp32.acm
msacm.msadpcm REG_SZ msadp32.acm
msacm.msg711 REG_SZ msg711.acm
msacm.msgsm610 REG_SZ msgsm32.acm
msacm.trspch REG_SZ tssoft32.acm
vidc.cvid REG_SZ iccvid.dll
vidc.I420 REG_SZ msh263.drv
vidc.iv31 REG_SZ ir32_32.dll
vidc.iv32 REG_SZ ir32_32.dll
vidc.iyuv REG_SZ iyuv_32.dll
vidc.mrle REG_SZ msrle32.dll
vidc.msvc REG_SZ msvidc32.dll
vidc.uyvy REG_SZ msyuv.dll
vidc.yuy2 REG_SZ msyuv.dll
vidc.yvu9 REG_SZ tsbyuv.dll
vidc.yvyu REG_SZ msyuv.dll
wavemapper REG_SZ msacm32.drv
msacm.msg723 REG_SZ msg723.acm
vidc.M263 REG_SZ msh263.drv
vidc.M261 REG_SZ msh261.drv
msacm.msaudio1 REG_SZ msaud32.acm
msacm.sl_anet REG_SZ sl_anet.acm
msacm.l3acm REG_SZ l3codecx.acm
vidc.iv41 REG_SZ ir41_32.ax
msacm.iac2 REG_SZ iac25_32.ax
vidc.iv50 REG_SZ ir50_32.dll
wave REG_SZ wdmaud.drv
midi REG_SZ wdmaud.drv
mixer REG_SZ wdmaud.drv
vidc.LEAD REG_SZ LCODCCMP.DLL
aux REG_SZ wdmaud.drv

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\drivers32\Terminal Server

Now my computer is operating searches inconsistently. I did two or three searches while I was waiting for your answer to the overwrite question and they were right, but after I completed the other actions I got redirects again! Ugh!

#13 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 19 January 2009 - 08:15 PM

Hello.

I can't tell much right now without any visible sings.

Could you please do any search using Google. Give me a screenshot of the Google Search you do. Do not click on any of the links in Google. Just type in anything and click Google Search. Give me a screenshot so I can see.

Now my computer is operating searches inconsistently. I did two or three searches while I was waiting for your answer to the overwrite question and they were right, but after I completed the other actions I got redirects again! Ugh!

What "other actions" are you talking about?

Also I would like you to check if the following files exists in the following locations:

Navigate to the folder C:\Windows\system32

In the system32 folder see if there is the following file names:
wdmaud.sys
sysaudio.sys


Do not do anything yet, just tell me if the exist or not.

Post back with:
-Screenshot
-Answer to my questions
-Run MBAM again (quick scan, Update it FIRST)


With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.

#14 Jessica211

Jessica211
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:23 AM

Posted 19 January 2009 - 09:17 PM

Ok, I think we are getting somewhere.

Note: I am not posting a screen shot because things are searching normally now. (And, I don't really know how to do that)

Just to clarify your questions.

You asked:
What "other actions" are you talking about?

I was just saying that in your last instructions there was a pause in my process while asking you a question about how to respond to the overwrite question. While I was waiting I tried a few searches and they seemed to work. Then, when you told me what to do with the overwrite question I performed the other actions in your instructions = typing "Y", then running another peek.bat.

You asked:
Also I would like you to check if the following files exists in the following locations:

Navigate to the folder C:\Windows\system32

In the system32 folder see if there is the following file names:
wdmaud.sys
sysaudio.sys

Neither of these are present.

Below is the log from the mbam (after updating):

Malwarebytes' Anti-Malware 1.33
Database version: 1668
Windows 5.1.2600 Service Pack 3

1/19/2009 9:08:48 PM
mbam-log-2009-01-19 (21-08-48).txt

Scan type: Quick Scan
Objects scanned: 69669
Time elapsed: 25 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Also, I did reboot my computer after seeing your last post and before running the mbam.

Everything seems to be operating normally. Searches are a little slower than they used to be, but I am hoping all signs point to the virus being eradicated??

Thank you thank you thank you!!

#15 extremeboy

extremeboy

  • Malware Response Team
  • 12,975 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:23 AM

Posted 19 January 2009 - 10:06 PM

Hello Jessica211.

Good, because everything also looks good from the batch you provided for me. It's probably you didn't reboot your computer or didn't restart IE for the changes to take in affect and that was why you still had some redirects. Glad everything is sorted now. :thumbsup:

Everything seems to be operating normally. Searches are a little slower than they used to be, but I am hoping all signs point to the virus being eradicated??

Viruses seen to be all eradicated and disintegrated. lol..

Let's run an online scan to make sure if there's anything else left.

Run Scan with Kaspersky

Please do a scan with Kaspersky Online Scanner.

If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Please disable your realtime protection software before proceeding. Refer to this page if you are unsure how.
  • Open the Kaspersky Scanner page.
  • Click on Accept and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis.

Post back with:
-Kaspersky log

With Regards,
Extremeboy
Note: Please do not PM me asking for help, instead please post it in the correct forum requesting for help. Help requests via the PM system will be ignored.

If I'm helping you and I don't reply within 48 hours please feel free to send me a PM.

The help you receive here is always free but if you wish to show your appreciation, you may wish to Posted Image.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users