Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unknown Program Possible Virus


  • Please log in to reply
12 replies to this topic

#1 crzy4draco90

crzy4draco90

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:26 AM

Posted 05 October 2010 - 11:33 AM

Hi,

I got a few nasty viruses that I successfully cleaned out with Malwarebytes. However, when I went to change a few start up program in msconfig, I noticed a few programs I did not recognize. They include:

A program called Goldg by 'Simon Tatham' that is in my temp folder and will not delete (this program always rechecks itself on start up even when I uncheck it).
A item called etemexuyi.
A item called Ydihaje.
(Both are in appdata>local)

I'm super paranoid that these are parts of the viruses that the antivirus missed. Can anyone help? Thanks.

BC AdBot (Login to Remove)

 


#2 destined

destined

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 07 October 2010 - 04:17 PM

I had this same problem with iGold by Simon Tatham on my computer yesterday. I can confirm this is indeed malware and I would strongly recommend you get rid of it ASAP. I too ran multiple antivirus / malware detection programs. Malwarebytes picked up some problems related to that program, but it wasn't able to get rid of it. None of the others were even able to detect it, even while my browser was being hijacked and redirected to numerous sites (most advertising sites, some porn sites). The only program I found which finally was able to recognize and then fix the problem was Privx. No problems since. It was free to download their Privx 3.0 diagnostic tool and it revealed the files as pkb.exe and pkc.exe hiding in a temp folder. It restored the registry files iGold had altered and fixed everything -- system scans clean by all programs, no longer being redirected, and am able to visit blocked sites again (it actually had blocked me from going to the Malwarebytes website).

I'm sure we aren't the only ones who have been affected by these .exe files but there seemed to be little information online about it. From what I read, the trojan or whatever it is changes the name of its .exe file a lot. Anyway, hope this helps.

Edited by destined, 07 October 2010 - 04:19 PM.


#3 crzy4draco90

crzy4draco90
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:05:26 AM

Posted 07 October 2010 - 08:21 PM

Hi,

Sorry I didn't reply. For some reason I didn't get an email that someone had replied.

I ended up trying to delete the goldg program in temp but then I realized its process was running. I then used rkill which terminated the process and deleted goldg from temp.

I downloaded and ran Privx like you suggested but it did not find anything. Problem is that I still have the redirect problem that I mentioned in the other post. Maybe goldg did something to the registry or changed its name so Privx couldn't find it? I'm not sure but I am going to try the solution posted in the other post and see what happens.

Thanks!

#4 destined

destined

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 07 October 2010 - 08:31 PM

I'm sorry to hear it didn't work for you. That was the only program that even recognized it on my computer, and no joke--I downloaded about 6 different programs. Yes, the virus/malware does change the registry. If your browser is still redirecting it is still active.

Good luck.

Edited by destined, 07 October 2010 - 08:32 PM.


#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:26 AM

Posted 07 October 2010 - 08:32 PM

Hi, let's try it once more please.

Reboot into Safe Mode with Networking
How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode with Networking using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.


>>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.

RKill....

Download and Run RKill
  • Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply
Do not reboot your computer after running rkill as the malware programs will start again. Or if rebooting is required run it again.


If you continue having problems running rkill.com, you can download iExplore.exe or eXplorer.exe, which are renamed copies of rkill.com, and try them instead.



Next run Superantisypware (SAS):

Download and scan with SUPERAntiSpyware Free for Home Users
  • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
  • In the Main Menu, click the Preferences... button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen.
  • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan.
  • Click "Next" to start the scan. Please be patient while it scans your computer.
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes".
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

Please ask any needed questions,post logs and Let us know how the PC is running now.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 dannydaman9

dannydaman9

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:26 AM

Posted 08 October 2010 - 03:32 AM

I had this yesterday and no antivirus software i had could remove it. Avast now detects it as Win32:Dropper-Drp [Trj]

This only applies to the iGold strain of it, unsure about any other names for it

The files are stored in c:\Users\[YOUR USERNAME]\AppData\Local\Temp

And the file names for what i had were: Dqelaa.exe, Dwr.exe and Dwq.exe

This also configures itself upon every boot up so nomatter what you do it will re-enable itself.

It has a tendency of blocking, redirecting and opening webpages without the users confirmation (for me it opened the national accident helpline website by opening IE9 beta itself)

To remove

Update avast to get the latest database or download the free version and scan your system
--To be safe i would suggest that you disconnect from the internet--
Either move to chest or delete (suggested that you delete)
Open Regedit
Find every trace of the above filenames (without .exe on the end)
Restart your computer then check


You should be fine then

Edited by dannydaman9, 08 October 2010 - 03:37 AM.


#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:26 AM

Posted 08 October 2010 - 03:44 PM

A suggestion has been made that involves modifying the registry. Modifying the registry can be dangerous (and can render your system unbootable) so it's advisable that you make a backup of the registry before proceeding.
Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot perform some of these steps or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry
  • Go Here and download ERUNT
    (ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
  • Install ERUNT by following the prompts
    (use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
  • Start ERUNT
    (either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
  • Choose a location for the backup
    (the default location is C:\WINDOWS\ERDNT which is acceptable).
  • Make sure that at least the first two check boxes are ticked
  • Press OK
  • Press YES to create the folder.
Registry Modifications

For more information about modifying the registry, see this Microsoft article: http://support.microsoft.com/default.aspx/kb/256986
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 greyseal2012

greyseal2012

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Yorkshire
  • Local time:10:26 AM

Posted 08 October 2010 - 09:32 PM

One of my systems was infected with GoldG on Thurs 7th Oct and I have spent hours trying to rid my system of it. It seems able to disable antivirus software and mutates when the system has access to the internet. I've tried almost everything I know to get rid of this little sod without success.

Edited by greyseal2012, 08 October 2010 - 09:33 PM.


#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:26 AM

Posted 09 October 2010 - 07:09 PM

@greyseal2012

When a system is reluctant to heal after running several tools the best thing is to post a DDs log
Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 kolotus33

kolotus33

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:26 PM

Posted 08 June 2011 - 09:25 AM

Im from Finland and im not very good in english so I hope u understand. I got this goldg too. Im new in this and i have ran mcafee, bugbear and prevx but nothing seems to help. Should I run rkill?

Edited by kolotus33, 09 June 2011 - 12:11 AM.


#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:26 AM

Posted 08 June 2011 - 09:52 AM

@ kolotus33.. please follow post 5 and post those logs.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 kolotus33

kolotus33

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:26 PM

Posted 10 June 2011 - 08:49 AM

Here it is:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/10/2011 at 03:02 PM

Application Version : 4.53.1000

Core Rules Database Version : 7244
Trace Rules Database Version: 5056

Scan type : Complete Scan
Total Scan Time : 05:49:52

Memory items scanned : 259
Memory threats detected : 0
Registry items scanned : 7966
Registry threats detected : 62
File items scanned : 768251
File threats detected : 195

Rogue.Agent/Gen
HKLM\Software\Classes\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}#AppID
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\InprocServer32#ThreadingModel
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\ProgID
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\Programmable
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\TypeLib
HKCR\CLSID\{0554F458-BC72-486D-9AAE-F5D719A933EF}\VersionIndependentProgID
HKCR\chkavwqhhst.chkavwqhhst.1.0
HKCR\chkavwqhhst.chkavwqhhst.1.0\CLSID
HKCR\chkavwqhhst.chkavwqhhst
HKCR\chkavwqhhst.chkavwqhhst\CLSID
HKCR\chkavwqhhst.chkavwqhhst\CurVer
HKCR\TypeLib\{18B5BB0D-DC38-4611-B16C-2A6A82FECAE5}
C:\WINDOWS\$XNTUNINSTALL643$\WKTLY.DLL
HKLM\Software\Classes\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}#AppID
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\InprocServer32#ThreadingModel
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\ProgID
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\Programmable
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\TypeLib
HKCR\CLSID\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}\VersionIndependentProgID
HKCR\adfavwqhpr.adfavwqhpr.1.0
HKCR\adfavwqhpr.adfavwqhpr.1.0\CLSID
HKCR\adfavwqhpr.adfavwqhpr
HKCR\adfavwqhpr.adfavwqhpr\CLSID
HKCR\adfavwqhpr.adfavwqhpr\CurVer
HKLM\Software\Classes\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}#AppID
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\InprocServer32
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\InprocServer32#ThreadingModel
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\ProgID
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\Programmable
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\TypeLib
HKCR\CLSID\{E178638F-36F7-48D5-B0ED-C653EBF17380}\VersionIndependentProgID
HKCR\brumavwqhgrm.brumavwqhgrm.1.0
HKCR\brumavwqhgrm.brumavwqhgrm.1.0\CLSID
HKCR\brumavwqhgrm.brumavwqhgrm
HKCR\brumavwqhgrm.brumavwqhgrm\CLSID
HKCR\brumavwqhgrm.brumavwqhgrm\CurVer
HKCR\TypeLib\{7B6A2552-E65B-4A9E-ADD4-C45577FFD8FD}
C:\WINDOWS\$XNTUNINSTALL643$\BUOMO.DLL
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E178638F-36F7-48D5-B0ED-C653EBF17380}
HKU\S-1-5-21-1343024091-448539723-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\S-1-5-21-1343024091-448539723-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E178638F-36F7-48D5-B0ED-C653EBF17380}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CF4A603B-2231-4ABA-AEFF-A1F02D9CBCE4}
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E178638F-36F7-48D5-B0ED-C653EBF17380}

Trojan.Agent/Gen-SSHNas[FakeAlert]
HKLM\System\ControlSet001\Services\SSHNAS
C:\DOCUME~1\VIKKET~1\LOCALS~1\TEMP\SSHNAS21.DLL
HKLM\System\ControlSet001\Enum\Root\LEGACY_SSHNAS
HKLM\System\ControlSet003\Services\SSHNAS
HKLM\System\ControlSet003\Enum\Root\LEGACY_SSHNAS
HKLM\System\CurrentControlSet\Services\SSHNAS
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_SSHNAS
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\SSHNAS21.DLL

Trojan.Dropper/Win-NV
HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS\Parameters
HKLM\SYSTEM\CurrentControlSet\Services\SSHNAS\Parameters#ServiceDll

Malware.Trace
HKU\S-1-5-21-1343024091-448539723-839522115-1003\Software\NtWqIVLZEWZU

Adware.Tracking Cookie
macromedia.com [ C:\Documents and Settings\Tiina\Application Data\Macromedia\Flash Player\#SharedObjects\7H4T3VK5 ]
media.tattomedia.com [ C:\Documents and Settings\Tiina\Application Data\Macromedia\Flash Player\#SharedObjects\7H4T3VK5 ]
stream.almamedia.fi [ C:\Documents and Settings\Tiina\Application Data\Macromedia\Flash Player\#SharedObjects\7H4T3VK5 ]
track.webgains.com [ C:\Documents and Settings\Tiina\Application Data\Macromedia\Flash Player\#SharedObjects\7H4T3VK5 ]
yo.static.presidiomedia.com [ C:\Documents and Settings\Tiina\Application Data\Macromedia\Flash Player\#SharedObjects\7H4T3VK5 ]
.fastclick.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
stat.www.fi [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.adtech.de [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.adtech.de [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.xiti.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
test.coremetrics.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
ads.revsci.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.edsa.122.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas3.emediate.se [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas3.emediate.se [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.nordea.112.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.revenue.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
tracking.frantic.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.bluestreak.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas4.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas4.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.imrworldwide.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.serving-sys.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas4.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.elkjop.112.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.redcats.122.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.zedo.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
media.adrevolver.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.statcounter.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
sitestats.ets.org [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
sitestats.ets.org [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.247realmedia.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.socialmedia.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.media.autotalli.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
eas8.emediate.eu [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.lfstmedia.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.winzip.122.2o7.net [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.media.causes.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Tiina\Application Data\Mozilla\Firefox\Profiles\q2ey056l.default\cookies.sqlite ]
C:\Documents and Settings\Tiina\Cookies\tiina@2o7[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@atdmt[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@bs.serving-sys[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@eas8.emediate[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@msnportal.112.2o7[1].txt
C:\Documents and Settings\Tiina\Cookies\tiina@sanoma-banner.inoob[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@serving-sys[1].txt
C:\Documents and Settings\Tiina\Cookies\tiina@track.adform[2].txt
C:\Documents and Settings\Tiina\Cookies\tiina@tradedoubler[2].txt
.atdmt.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.microsoftsto.112.2o7.net [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
statse.webtrendslive.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.adtech.habbo.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.adtech.de [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
track.adform.net [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
track.adform.net [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.adform.net [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.server.cpmstar.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
.tradedoubler.com [ C:\Documents and Settings\Veeti\Application Data\Mozilla\Firefox\Profiles\cd55h4up.default\cookies.sqlite ]
C:\Documents and Settings\Veeti\Cookies\veeti@atdmt[2].txt
C:\Documents and Settings\Veeti\Cookies\veeti@microsoftsto.112.2o7[1].txt
139.memecounter.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
142.memecounter.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
83.memecounter.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
a.ads2.msads.net [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
googleads.g.doubleclick.net [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
ia.media-imdb.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
media.disneyinternational.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
media.ign.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
media.mtvnservices.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
media.nintendo.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
media.noob.us [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
memecounter.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
mitzi-media.smartvideochannel.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
objects.tremormedia.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
secure-uk.imrworldwide.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
serving-sys.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
stream.almamedia.fi [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
videomedia.ign.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
wdw1.wdpromedia.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
www.naiadsystems.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
www.ziporn.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
wwwstatic.megaporn.com [ C:\Documents and Settings\Vikke Tiirola\Application Data\Macromedia\Flash Player\#SharedObjects\ZHWJX7NX ]
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.360yield[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.adnetwork[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.e-viral[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.globe7[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.yieldads[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.yieldmanager[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad.zanox[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ad6media[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@adform[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ads.avazu[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ads.cpxcenter[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ads.horyzon-media[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@ads.inextmedia[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@adserver.adtechus[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@advertise[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@adxpose[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@aimfar.solution.weborama[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@atdmt.combing[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@atdmt[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@clickbank[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@clicksor[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@content.yieldmanager[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@fidelity.rotator.hadj7.adjuggler[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@find.10topsearches[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@harrenmedianetwork[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@invitemedia[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@liveperson[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@media6degrees[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@mediabrandsww[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@mm.chitika[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@mtrack.adeffie[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@myroitracking[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@servedby.adxpower[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@server.cpmstar[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@server.iad.liveperson[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@stat.www[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@statcounter[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@track.adform[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@uk.at.atwola[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@vidasco.rotator.hadj7.adjuggler[2].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@westernunionglobal.112.2o7[1].txt
C:\Documents and Settings\Vikke Tiirola\Local Settings\Temp\Cookies\vikke tiirola@zanox[2].txt
C:\WINDOWS\Temp\Cookies\system@ad.yieldmanager[2].txt
C:\WINDOWS\Temp\Cookies\system@adform[1].txt
C:\WINDOWS\Temp\Cookies\system@adserver.adtechus[1].txt
C:\WINDOWS\Temp\Cookies\system@adtechus[1].txt
C:\WINDOWS\Temp\Cookies\system@atdmt[1].txt
C:\WINDOWS\Temp\Cookies\system@content.yieldmanager[2].txt
C:\WINDOWS\Temp\Cookies\system@doubleclick[1].txt
C:\WINDOWS\Temp\Cookies\system@invitemedia[2].txt
C:\WINDOWS\Temp\Cookies\system@media6degrees[2].txt
C:\WINDOWS\Temp\Cookies\system@mtrack.adeffie[2].txt
C:\WINDOWS\Temp\Cookies\system@track.adform[2].txt

Trojan.Agent/Gen-IExplorer[Fake]
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\RARSFX0\NIRD\IEXPLORE.EXE

Trojan.Agent/Gen-PEC
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\RARSFX0\PROCS\EXPLORER.EXE

Trojan.Agent/Gen-FraudSpy
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLJ.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLK.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLL.EXE

Trojan.Agent/Gen-FakeSoft
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLM.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLN.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLO.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLP.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLQ.EXE
C:\WINDOWS\VNENOA.EXE
C:\WINDOWS\Prefetch\VNENOA.EXE-0C2B17BE.pf

Trojan.Agent/Gen-Frauder
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLR.EXE
C:\DOCUMENTS AND SETTINGS\VIKKE TIIROLA\LOCAL SETTINGS\TEMP\VLS.EXE

Trojan.Agent/Gen-Exploit
C:\WINDOWS\TEMP\PAIB\SETUP.EXE
C:\WINDOWS\Prefetch\SETUP.EXE-0AFF1750.pf

Thx for help^^. Im really newbie and noob in this, so i didn't have any possibillity to do this without guide. Thanks a lot Boopme: ) And my computer works normal!

Edited by kolotus33, 10 June 2011 - 09:03 AM.


#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,762 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:26 AM

Posted 10 June 2011 - 01:40 PM

You're welcome.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users