Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

multiple infections - low memory resources - I may be out of luck?


  • Please log in to reply
8 replies to this topic

#1 blenny

blenny

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 11:07 AM

Greetings

My first time registering at this forum but I have consulted here a number of times w/ issues and have usually found ideal help. I may be out of luck this time though.

I'm running XP (sp3)- P4 and 1Gb Ram(old) and have been using NOD32 AV, Spybot, and then also have Super Antispyware (free) installed and also Malwarebytes. In December/January I had a "minor" infection w/ the "google" or "yahoo" virus which I believe I was able to remove (malware bytes on a flash drive). After then in January I had another minor infection w/ tdss (recollection on name) which I thought I removed. After this, it seemed my Spybot was less effective than in the past (hind sight now). It now seems as if it blocked my spybot entirely?

Yesterday I got hit with a major virus/trojan infection from multiple fronts. I have been using Malware Bytes and Super Antivirus to scan and try and remove these pests. I'm at my work computer right now so I'm going off recollection. Two or 3 of the infections were in the memory stores (according to SAV software) and then 64 infections in the registery and then several more in "files." I am able to scan for the infections but then am unable to reboot to remove/quarentine them. One of them hijacked my desktop and placed a notice in my system tray saying my computer was infected. I love their humor despite wanting to punch them! :thumbsup:

I have tried in Safe Mode and also safe mode /w the intenet connection blocked. I have removed some of the files manually as that seemed to be my only option. Prunnet.exe was one and then a few others placed in the system32 folder. One of the files in registry was "juan" (whole battery of them).

Any ideas where I can start or what to do? I'm looking at a rebuild but that is my last choice. How can I remove anything if I can't reboot? Whatever is infecting the PC is pulling the system resources restricting the reboot process. Or it's smart enough to make sure I can't reboot.

Any help is wonderful! I will do my best to answer questions and/or follow directions to the detail.

thanks!
bleeny.

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:09 PM

Posted 03 March 2009 - 12:00 PM

Welcome.

I am able to scan for the infections but then am unable to reboot to remove/quarentine them

Please be more specific. Exactly what happens when you try rebooting?

Please post the results of your MBAM scan for review.

To retrieve the MBAM scan log information, launch MBAB.
  • Click the Logs Tab at the top.
    • The log will be named by the date of scan in the following format:
      mbam-log-2009-01-12(13-35-16).txt <- your dates will be different from this example
      -- If you have previously used MBAM, there may be several logs showing in the list.
  • Click on the log name to highlight it.
  • Go to the bottom and click on Open.
  • The log should automatically open in notepad as a text file.
  • Go to Edit and choose Select all.
  • Go back to Edit and choose Copy or right-click on the highlighted text and choose copy from there.
  • Come back to this thread, click Add Reply, then right-click and choose Paste.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 blenny

blenny
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 12:11 PM

"Please be more specific. Exactly what happens when you try rebooting?"


The memory resources are so dwindled that I am unable to reboot - that is, whenever I run any scan - CC Cleaner, MBAM, SVAS the resources are dwindled so that I get the message "not enough system resources are available to complate this tast" (or however the wording goes. I would even get this for a .txt doc.

When I run a scan for MBAM or SAVS - the quarentine hangs up for SAVS. It will last several hrs without making progress through the quarentine process. When I kill the process or even try to open up the txt file, I get the system resources prompt. I tried MBAM once and I recalled that getting bogged down as well - I don't recollect much on the MBAM.

Thanks for your reply and help!!! I will retry MBAM in Safe Mode and attempt to get the log as you have indicated.

I really appreciate your help!

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:09 PM

Posted 03 March 2009 - 12:42 PM

Have you tried just rebooting manually instead of through any scanning tools?

Scanning with MBAM in safe or normal mode will work but removal functions are not as powerful in safe mode. MBAM is designed to be at full power when malware is running so safe mode is not necessary when using it. In fact, it loses some effectiveness for detection & removal when used in safe mode because the program includes a special driver which does not work in safe mode. Further, scanning in safe mode prevents some types of malware from running so it may be missed during the detection process. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Doing a safe mode scan should only be done when a regular mode scan fails.

If you cannot use or complete a scan in normal mode, then try performing a Quick Scan in "Safe Mode".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 blenny

blenny
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 01:45 PM

Thanks for the information quietman.

I made some headway I think. I was able to get a normal reboot completed and then block a number of apps from the internat. I also get a consistent hpqthb08.exe error (oxc00007b) on reboot and then a xccef090131.exe trying to redirect using my homepage.

I was able to get a quick scan completed through MBAM. I relaoded the MBAM software to my flash drive and ran the quick scan (for starters). I was also able to reboot whereas it was gettign hung up before on the shut down. On the reboot i did get a system 32/3361/svchost.exe error. MBAM was not able to remove all items from this quckscan. Maybe this is evident in the log posted below? I will start a full scan now.

Log




Malwarebytes' Anti-Malware 1.34
Database version: 1815
Windows 5.1.2600 Service Pack 3

3/3/2009 12:31:56 PM
mbam-log-2009-03-03 (12-31-50).txt

Scan type: Quick Scan
Objects scanned: 77921
Time elapsed: 2 minute(s), 55 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 6
Registry Keys Infected: 22
Registry Values Infected: 11
Registry Data Items Infected: 12
Folders Infected: 0
Files Infected: 39

Memory Processes Infected:
C:\WINDOWS\system32\hgcheck.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\mepawadi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\latuwusa.dll (Trojan.Vundo.H) -> No action taken.
c:\WINDOWS\system32\netojeke.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\zmvckx.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\xccdf16_090131a.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\xccdf32_090131a.dll (Spyware.OnlineGames) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b03bf09d-2827-4260-9da6-e9fd13242246} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b03bf09d-2827-4260-9da6-e9fd13242246} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6ab61eaf-92e8-4d1d-b8b6-d42daf0c199e} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6ab61eaf-92e8-4d1d-b8b6-d42daf0c199e} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6ab61eaf-92e8-4d1d-b8b6-d42daf0c199e} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b03bf09d-2827-4260-9da6-e9fd13242246} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdss.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EKRN.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GUARD.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCSHIELD.exe (Security.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe (Security.Hijack) -> No action taken.
HKEY_CLASSES_ROOT\Applications\nxtepad.exe (Hijack.Notepad) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defaultlib (Spyware.Passwords) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\905dec88 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm936edf14 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zisanuwusa (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\uqpinit_dlls (Spyware.Agent.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hgcheck (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xccinit (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\netojeke.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\netojeke.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CLASSES_ROOT\txtfile\shell\open\command\ (Hijack.Notepad) -> Bad: ("C:\WINDOWS\system32\nxtepad.exe" "%1") Good: (notepad.exe %1) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\zmvckx.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\mepawadi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\idawapem.ini (Trojan.Vundo.H) -> No action taken.
c:\WINDOWS\system32\netojeke.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\latuwusa.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\nvtpm32.dll (Spyware.Agent.H) -> No action taken.
C:\WINDOWS\system32\matiberi.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\hguest.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\hgcheck.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\998.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\seneka.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekalog.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\azton.mt (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\inf\xccefb090131.scr (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\3361\SVCHOST.EXE (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\msrstart.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\nxtepad.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\umtcdtw.sys (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\tpszxyd.sys (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\inf\rundll33.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\xccdf16_090131a.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\xccdf32_090131a.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system\xccef090131.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\inf\xccdfb16_090131.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\senekalwbxtewf.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekaqxhkdkqr.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekasmpuxtit.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekatjgvppjx.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\senekatjwmnykr.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\senekaufjwmyxy.sys (Trojan.Agent) -> No action taken.

#6 blenny

blenny
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 02:07 PM

In the process of running full MBAM scan. In the middle of the process I'm getting an svchost.exe app error. ""0x66d46de0" referenced memory "0x000000" memory could not be written. Ok to terminal or cancel to debug"

Not sure what it means but hopefully info to help. I will post full scan shortly as it should be near completion.

Thanks
blenny

#7 blenny

blenny
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 02:15 PM

Here is the full scan log. There was not a prompt to reboot after this scan. Thank you immensely!
Malwarebytes' Anti-Malware 1.34
Database version: 1815
Windows 5.1.2600 Service Pack 3

3/3/2009 1:12:06 PM
mbam-log-2009-03-03 (13-12-06).txt

Scan type: Full Scan (C:\|)
Objects scanned: 147643
Time elapsed: 23 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

#8 blenny

blenny
  • Topic Starter

  • Members
  • 27 posts
  • OFFLINE
  •  
  • Local time:12:09 PM

Posted 03 March 2009 - 02:20 PM

My firewall is blocking a "userinit Logon App (init32.exe)" on reboot after this latest full scan. I will block it w/ my firewall.

thx

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,756 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:09 PM

Posted 03 March 2009 - 02:36 PM

MBAM has a built-in FileAssassin feature for removing stubborn malware or other malicious files that it did not detect.
  • Go to the "More Tools" tab and click on the "Run Tool" button
  • Browse to the location of the file (init32.exe) to remove using the drop down box next to "Look in:" at the top.
  • When you find the file(s), click "Open".
  • You will be prompted with a message warning: This file will be permanently deleted. Are you sure you want to continue?. Click Yes.
  • If removal did not require a reboot, you will receive a message indicating the file was deleted successfully, however, I recommend you reboot anyway.

Caution: Be careful what you delete. FileAssassin is a powerful program, designed to move highly persistent files. Using it incorrectly could lead to serious problems with your operating system.


-- If the file returns, then you probably have other malware on your system which is protecting or regenerating it.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users