Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijackthis log from infected 'puter


  • This topic is locked This topic is locked
16 replies to this topic

#1 TrapperP

TrapperP

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 20 June 2005 - 08:03 PM

Help! My computer displays the blue screeew with the msg "A fatal error in IE has coourred @ 0028:C0011E36 in VXD VMM(01) + 00010E36. Error was caused by trojan-spy.HTML.Smitfraud.com"
Any thing I try to run re Spyware - SpyBot, etc comes back with the following:
1) Error Loading E6F1873B.DLL
2) Error Loading Stlb2.dll
3) Error Loading DOCEOC16B1

I went into "safe" mode and ran a Hijackthis log (attached)
Please help - this thing has me whipped.
Best regards,
TrapperP

Logfile of HijackThis v1.99.1
Scan saved at 7:05:27 PM, on 6/15/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\Ted\Application Data\aone.exe
C:\WINDOWS\explorer.exe
C:\DOCUMENTS AND SETTINGS\TED\DESKTOP\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=0
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\BPIJOI~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKLM\..\Run: [Norton Antivirus AV] C:\WINDOWS\FVProtect.exe
O4 - HKLM\..\Run: [sm] C:\WINDOWS\sa_exe.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [firewall_anti] C:\WINDOWS\firewall_anti.exe
O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\zxv6vt4s1eywlthd.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Fkvc] C:\WINDOWS\System32\??chost.exe
O4 - HKCU\..\Run: [Stpn] C:\Documents and Settings\Ted\Application Data\aone.exe
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [keydrv.exe] C:\WINDOWS\System32\winsystems.exe
O4 - Global Startup: dx32cxlp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl...22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5011C2F9-F9CC-4297-9C3E-3DA3E863DC8B}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70D7F017-4E98-402B-BC6F-CC06959791D8}: NameServer = 209.244.0.3 209.244.0.4
O20 - AppInit_DLLs: gyldwhv4zj.dll
O23 - Service: Workstation NetLogon Service (O? rtȲ$
) - Unknown owner - C:\WINDOWS\appxv32.exe (file missing)


Many thanks in advance.
TrapperP

BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 21 June 2005 - 07:16 AM

Hello,

Any reason why your windows isn't up to date? You don't have even ServicePack1 installed! Remember that your system is extremely vulnerable without the necessary security patches/updates, so malware can get installed automatically while surfing without any problems.
Because your system is already infected, updating now CAN cause problems, so let's get you updated when everything is fixed again.

We need to perform this in different steps, because you have a lot of different infections which need a special treatment.

Download swap.zip from next location:
http://forums.skads.org/index.php?showtopic=81

(you'll find swap.zip as an attachement there)

Unzip the folder, but make sure all those files are still present in the same folder swap!!

Doubleclick swap.bat.
Don't worry, your computer will reboot by itself, so let it finish the job.

When rebooted..

go to next site:
http://virusscan.jotti.org/

On top you'll find: File to upload and scan.
Now browse to the next file:

C:\WINDOWS\System32\wininet.dll

Click submit and let it scan.
Post the results in your next reply together with a hijackthislog made in normal mode!!
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 21 June 2005 - 08:41 PM

Jotti's malware scan 2.99-TRANSITION_TO_3.00
File to upload & scan: Virus

Service
Service load:
0% 100%
File: wininet.dll
Status:
INFECTED/MALWARE
MD5 5106dfdcf3de3808ebf0ddf60d6bfd0f
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found Trojan.DownLoader.2636
F-Prot Antivirus
Found nothing
Fortinet
Found Nsag.A
Kaspersky Anti-Virus
Found Virus.Win32.Nsag.a
NOD32
Found Win32/Oleloa.A
Norman Virus Control
Found nothing
VBA32
Found Virus.Win32.Nsag.a

And then ran Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 9:34:19 PM, on 6/21/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUMENTS AND SETTINGS\TED\DESKTOP\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=0
R3 - Default URLSearchHook is missing
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKLM\..\Run: [Norton Antivirus AV] C:\WINDOWS\FVProtect.exe
O4 - HKLM\..\Run: [sm] C:\WINDOWS\sa_exe.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [firewall_anti] C:\WINDOWS\firewall_anti.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Fkvc] C:\WINDOWS\System32\??chost.exe
O4 - HKCU\..\Run: [Stpn] C:\Documents and Settings\Ted\Application Data\aone.exe
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [keydrv.exe] C:\WINDOWS\System32\winsystems.exe
O4 - Global Startup: dx32cxlp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl...22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5011C2F9-F9CC-4297-9C3E-3DA3E863DC8B}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70D7F017-4E98-402B-BC6F-CC06959791D8}: NameServer = 209.244.0.3 209.244.0.4
O23 - Service: Workstation NetLogon Service (O?rtȲ$) - Unknown owner - C:\WINDOWS\appxv32.exe (file missing)

Many thanks for the help. I will be unable to respond or do anything further from this computer until after the weekend as I am scheduled for an out of town trip. Eager to see how far we can go with this (Fingers crossed!)
As to why no windows update, a bit of history. I bought this computer through Delta Airlines Wired Work Force program and the computer died after about two years - fatal head crash, I was told. Anyway, a friend of a friend rebuilt the box by replacing the hard drive, etc. I'll have to confess ignorance as I thought the windows upgrades were automatic. Probably would hve been benefical for me to chck this, no?
Again thanks so very much, and I look forward to working with you on my probalem again.
Best regards,
TrappeP

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 22 June 2005 - 02:05 AM

Hello,

It's better to print out the next instructions or save it in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!

Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
(Don't forget this step!!)

Download AboutBuster.
Unzip AboutBuster in an own folder such as C:\AboutBuster.
Start AboutBuster.exe. Click OK, Update, Check For Update and download the updates if present.
Close aboutbuster now, because you may not run it yet, that's for later.
If You are getting an error when updating, please let me know first before you proceed with the next steps.

* Download and install CCleaner
Do not use it yet.

* Download this regfix: HSfix
Unzip it and place it on your desktop, don't use it yet!

Download CWShredder. Start CWShredder and click FIX

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://win-eto.com/sp.htm?id=0
R3 - Default URLSearchHook is missing
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\System32\stlb2.dll
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKLM\..\Run: [Norton Antivirus AV] C:\WINDOWS\FVProtect.exe
O4 - HKLM\..\Run: [sm] C:\WINDOWS\sa_exe.exe
O4 - HKLM\..\Run: [firewall_anti] C:\WINDOWS\firewall_anti.exe
O4 - HKCU\..\Run: [Fkvc] C:\WINDOWS\System32\??chost.exe
O4 - HKCU\..\Run: [Stpn] C:\Documents and Settings\Ted\Application Data\aone.exe
O4 - HKCU\..\Run: [winshost.exe] C:\WINDOWS\System32\winshost.exe
O4 - HKCU\..\Run: [keydrv.exe] C:\WINDOWS\System32\winsystems.exe
O4 - Global Startup: dx32cxlp.exe
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O23 - Service: Workstation NetLogon Service (O?rtȲ$) - Unknown owner - C:\WINDOWS\appxv32.exe (file missing)


* Click on Fix Checked when finished and exit HijackThis.

* Reboot into Safe Mode`: ( without networking support !)
To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key.


* Using Windows Explorer, locate the following files and delete them if still present:

C:\WINDOWS\System32\stlb2.dll
C:\WINDOWS\System32\winshost.exe
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\sa_exe.exe
C:\WINDOWS\firewall_anti.exe
C:\Documents and Settings\Ted\Application Data\aone.exe
C:\WINDOWS\System32\winsystems.exe
C:\WINDOWS\appxv32.exe
C:\new.exe
C:\windows\system32\wp.bmp

Search for next files and delete them:
(most probably present in your windows-folder or system32-folder)

E6F1873B.DLL
D9EBC318C
D0CE0C16B1

*Go to start >run and type: services.msc and click OK
Scroll down in that list until you find the service Workstation NetLogon Service
Doubleclick on it. In the window that will appear, click on "Stop" (if not greyed out) and change the Startup Type to disabled.
Click apply and OK and close all open windows.

*Start Aboutbuster and let it scan. When the scan is done and you choose exit, it will automatically create a log in the same folder where aboutbuster is in.

* Doubleclick on HSfix you downloaded earlier before which is present on your desktop and when it asks you if you want to add the contents to the registry, click yes/ok

* Still in safe mode Run Ccleaner and click Run Cleaner (bottom right)

For the wininet.dll..

There is also a wininet.dll present in your C:\windows\system32\dllcache-folder, that's a good one.

Go to your C:\Windows\system32-folder and rename the bad wininet.dll to wininet.old
Go to your C:\Windows\system32\system32\dllcache-folder and rightclick on the good wininet.dll and choose copy.
Go back to your C:\Windows\system32-folder, rightclick anywhere in that folder and choose paste.
If there is no wininet.dll present in your dllcache, look if there is one in next folder: C:\WINDOWS\ServicePackFiles\i386 so copy that one to the system32-folder.
It could be possible you'll get an error saying the file already exists when you try to paste the good one in your system32-folder.
If it gives an error again, just reboot.

Check afterwards if there is a new wininet.dll in your system32-folder and if the wininet.old is also present. If so, delete the wininet.old.
Also delete C:\Windows\System32\oleadm.dll

There is however a small chance that after reboot your explorer wont load. That's because of the wininet.dll missing in your system32-folder.
If this happens, after reboot you wont have any problems to replace to good wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.
That must solve the problem. Because your explorer wont load then, you'll need to perform everything via taskmanager then (ctrl-alt-del) > applications > new task > browse

Also after reboot..

Download next regfix: Fix_Protocol_zones_ranges
Doubleclick on it and when it asks you if you want to add the contents to the registry, click yes/ok

* Download http://metallica.geekstogo.com/smitfraud.reg and save it on your desktop
Doubleclick on it and when it asks you if you want to add the content to the registry, click yes/ok.

* Download the Hoster from HERE Press "Restore Original Hosts" and press "OK". Exit Program.

* Perform an onlinescan with Kaspersky OnLine and/or Bitdefender and let it delete everything it is finding.

*Post a new hijackthis-log + log aboutbuster which you'll find in the aboutbuster-folder

Also, Upload and Scan that new C:\Windows\system32\wininet.dll on next site to make sure this one is clean:

http://virusscan.jotti.org/

let it scan and post the results also in your next reply
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 26 June 2005 - 06:36 PM

Good evening! Thought I would give it a try and got as far as downloading AboutBuster. Will not allow me to procede - I receive following error msg: "Run-time error '48': File not found: WININET.dll"
What do we do next?
Regards,
TrapperP

#6 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 26 June 2005 - 06:51 PM

Have you been reading my above post about the wininet.dll?
You need to copy a wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.

Please read above again.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 26 June 2005 - 07:41 PM

I'm missing something - I have gone back and re and then re-read the entire thread and see no previous reference to wininet.dll - is it in another thread? Sorry if I come across as thick headed. :thumbsup:
Regards,
TrapperP

#8 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 26 June 2005 - 09:17 PM

If you look 2 posts above, this is what I wrote:

For the wininet.dll..

There is also a wininet.dll present in your C:\windows\system32\dllcache-folder, that's a good one.

Go to your C:\Windows\system32-folder and rename the bad wininet.dll to wininet.old
Go to your C:\Windows\system32\system32\dllcache-folder and rightclick on the good wininet.dll and choose copy.
Go back to your C:\Windows\system32-folder, rightclick anywhere in that folder and choose paste.
If there is no wininet.dll present in your dllcache, look if there is one in next folder: C:\WINDOWS\ServicePackFiles\i386 so copy that one to the system32-folder.
It could be possible you'll get an error saying the file already exists when you try to paste the good one in your system32-folder.
If it gives an error again, just reboot.

Check afterwards if there is a new wininet.dll in your system32-folder and if the wininet.old is also present. If so, delete the wininet.old.
Also delete C:\Windows\System32\oleadm.dll

There is however a small chance that after reboot your explorer wont load. That's because of the wininet.dll missing in your system32-folder.
If this happens, after reboot you wont have any problems to replace to good wininet.dll from your dllcache or C:\WINDOWS\ServicePackFiles\i386-folder back to your system32-folder.
That must solve the problem. Because your explorer wont load then, you'll need to perform everything via taskmanager then (ctrl-alt-del) > applications > new task > browse


AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 27 June 2005 - 05:52 AM

Apologies, apologies - I DID NOT READ THAT! When it would not let me open AboutBuster, I stopped. I'll go back and try again tonight if I can get home in time.
Will try and do better.
Regards,
TrapperP

#10 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 27 June 2005 - 05:54 AM

Ok.. first fix that wininet.dll and then you'll be able to run programs properly again. :thumbsup:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#11 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 29 June 2005 - 08:14 PM

Okay, finally had time to run it all down. Here goes:

Logfile of HijackThis v1.99.1
Scan saved at 8:59:05 PM, on 6/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUMENTS AND SETTINGS\TED\DESKTOP\hijackthis.exe

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl...22/ComCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5011C2F9-F9CC-4297-9C3E-3DA3E863DC8B}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70D7F017-4E98-402B-BC6F-CC06959791D8}: NameServer = 209.244.0.3 209.244.0.4



AboutBuster 5.0 reference file 28
Scan started on [6/29/2005] at [7:40:22 PM]
------------------------------------------------
Removed Stream! C:\WINDOWS\AuHCcup1.ini:pxsqb
Removed Stream! C:\WINDOWS\tmupdate.ini:qklzz
Removed Stream! C:\WINDOWS\winhlp32.exe:kwyii
Removed Stream! C:\WINDOWS\WMSysPrx.prx:muwsk
------------------------------------------------
Removed File! : C:\Windows\xelud.dat
Removed File! : C:\Windows\zzbpl.dll
Removed File! : C:\Windows\System32\fnmva.dll
Removed File! : C:\Windows\System32\zzfng.dll
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 7:42:12 PM


And the Jotti scan:
Jotti's malware scan 2.99-TRANSITION_TO_3.00
File to upload & scan: Virus

Service
Service load:
0% 100%
File: WININET.DLL
Status:
OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 6626545292428ae1ed5b4237404b346a
Packers detected:
-
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VBA32
Found nothing


Finally, I am getting a new (?) error message when I reboot:
"Found new Hardware - Unimodem Full-Duplex Audio Device" in lower r/h corner and then a pop-up stating:
" File MODEMCSA.sys on (UnKnown) is needed"
I think I will just have to de-install the modem, then come back with the CD and re-install? Wanted to run it by you first.

And there is no longer a blue screen with dire warnings when I re-boot.
So, what next?
Best regards,
TrapperP

#12 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 30 June 2005 - 12:24 AM

Hello,

Your hijackthislog looks clean again.
There are some things you need to check:

It could be possible that this hijacker deleted some files, so check if the following are still present:

Control.exe: Is in your C:\WINDOWS\system32. Download here when missing.

Hosts: C:\WINDOWS\SYSTEM32\DRIVERS\ETC .Download here when missing.
Unzip hoster to an own folder, eg C:\Hoster
Start Hoster.exe, click 'Restore Original Hosts' and click OK. Close the program.

Shell.dll: C:\WINDOWS\SYSTEM32 Download here when missing

SDHelper.dll:
If you are using Spybot Search & Destroy, this hijacker can also delete SDHelper.dll.
Download SDHelper.dll.
Place the file in the Spybot Search & Destroy-folder. Most probably, this ist C:\Program Files\Spybot - Search & Destroy

For the 'error' you get.. that's not an error.. It just shows you that there is new hardware found.
You can find MODEMCSA.sys here:
http://www.dynamiclink.nl/htmfiles/rframes...s/info_m/44.htm

How are things running now?
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#13 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 07 July 2005 - 05:18 AM

Sorry to be so long in getting back to you but really busy and away from the computer at home. It seems to be in apple pie order but I have some questions I would like answers for (tutorial help?).
Let me set up a tableau:
CWShredder shows "CoolWebSearch was not found on this system."
And SpyBot does not find any threats.
Yet when I run XOFTSPY, it comes back with a host of findings ranging from 'Annoyance' to 'High Threat'
Some samples would be such things as "Software/EZULA"; "software/ClickSpring"; "Software/midaddle"; "SYSTEM\CurrentControlSet\Services\dx32cxel"; CLSID\(EB381422-F797-4A98-A266-9DC490821907)"; etc. - a total of 32 like items.
If I run a search query on any of these they do not show up, at least none of the half dozen or so that I have tested. Of course, I am running the free share ware portion of XOFTSPY so cannot use it to 'fix' - would not wish to in any event without checking with you first.
I ran a HiJackThis scan and another XOFTSPY and emailed the logs to myself but they did not come through the firewall to my office computer so I can't forward them from here. Would it be of help for me to forward them to you when I get back to my home computer?
Think that is all from that angle so we go to next step. What if any further precautions are in order fot the computer we worked with - my home computer? Should I install any type of firewall and if so what do you recommend? I use Mozilla FireFox as a web browser and it has some sort of inclusive firewall, not sure if I need or should use more or another type of protection.
And finally, for this message - I intend to make a contibution to Bleeping Computer as a token of my appreciation for the help you have rendered and the patience you have shown. Would it be possible to do so with some recognition of you and your contributions and if so, how do I proceed?
Thanks again for the help. I look forward to your reply.
Best regards,
TrapperP

#14 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:41 AM

Posted 07 July 2005 - 07:45 AM

Hello,

About Xoftspy... I want you to show something:
Read this: http://www.spywarewarrior.com/rogue_anti-s...re.htm#xos_note

It was (and I think it still is) a rogue so called spywareremover that gives false positives work as goad to purchase. And as you said, you use the free portion of it. So don't worry at all and don't believe what Xoftspy is telling you.
Actually, I rather suggest you uninstall it and stick with adaware Se and Spybot s&d which are trustworthy antispywarescanners. :thumbsup:

Yes, I do suggest a firewall and a decent antivirus, because of what I see in your hijackthislog, no antivirus (mcafee) is actually running in the background to secure your system.

AVG, Bitdefender OR Avast are good FREE antivirus.
Never install more than one antivirusscanner or firewall on your system! Several together can give problems and decreases the reliability of it seriously!
Zonealarm, Kerio OR Sygate are FREE firewalls.

Understanding and using firewalls:
http://www.bleepingcomputer.com/forums/ind...showtutorial=60

About the contribution, you can choose in here. Or you can contribute to bleeping computers itself: http://www.bleepingcomputer.com/supportus.php#donation
Or you can contribute to me (look in my signature for the link)
But you don't have to contribute, my help stays always free. :flowers: So whatever you choose, it's much appreciated.

To keep this clean in the future, I would suggest the following things:

Most important thing here --- Visit asap http://windowsupdate.microsoft.com to download and install all the updates and security patches!!

Install Spywareblaster
SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

Avoid illegal sites, because that's where most malware is present.

Let your antispywarescanner(s) scan frequently and don't forget to update before.

And I do suggest you perform an online virusscan once in a while. (Kaspersky online and/or Bitdefender). Because what one virusscanner can't find another one maybe can.
Also make sure that your virusscanner, the one that is installed on your system is always up to date!

Make sure your windows has the latest updates: http://windowsupdate.microsoft.com/

More info on how to prevent malware you can also find here (By Tony Klein)

Happy surfing again! :trumpet:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#15 TrapperP

TrapperP
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 07 July 2005 - 08:19 AM

AS always, thanks fot the prompt reply and the advice. Will try and comply with all as soon as I can get back to the home computer. Seems I am always away!
Best regards,
'Trapper'




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users