Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

No clue how I got infected with the Trojan but need help, constant pop ups etc.


  • This topic is locked This topic is locked
11 replies to this topic

#1 ZeSloth

ZeSloth

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 22 November 2016 - 09:54 AM

So I finally got hit with a trojan, I believe through a steam chat link from an old account of a friend that I stupidly clicked.

 

Symptoms are:

 

-Pop ups everywhere

-Random downloaded applications

-Slow computer

-Windows defender scanning blocked

-Any malware removed through adwcleaner reappearing

-Chrome addons appearing

-Chrome redirects

 

I've tried running defender in offline but it won't start the offline scans, keeps coming up with errors. Also, as stated earlier adwcleaner is removing malware but they just keep reappearing.

 

I have done an initial FRST but the post is too long for the topic, so I have attached the addition as well as the FRST file (I know I shouldn't attach the FRST but post is too long otherwise).

 

Thanks,

 

ZeSloth

Attached Files



BC AdBot (Login to Remove)

 


#2 ZeSloth

ZeSloth
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 23 November 2016 - 04:37 AM

Ok so after some trial and error I think I got rid of the trojan, it was mainly a password stealer under the id of trojan.passwordstealer.msil 

 

I achieved this through a complete scan with malwarebytes and hitman pro, however, just to be safe could anyone advise me as to how I can be 100% certain that I am clean?

 

Thanks,

 

ZeSloth



#3 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 25 November 2016 - 05:17 PM

Hi ZeSloth and welcome to BC.

I achieved this through a complete scan with malwarebytes and hitman pro, however, just to be safe could anyone advise me as to how I can be 100% certain that I am clean?


There were entries in your original reports that needed to be addressed.
Now that you have used MalwareBytes and HitMan Pro, I need to see a set of updated reports.

Please re-run FRST.
  • Make sure that Addition.txt is selected at the bottom
  • Press Scan button.

    newfrst_zpsa63ffa3d.png
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • It will also make another log (Addition.txt). Please copy and paste it to your reply also.
In your next reply, please submit:
New set of FRST reports.


Thanks.

BBPP6nz.png


#4 ZeSloth

ZeSloth
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 26 November 2016 - 04:11 AM

I keep attempting to copy over the frst scan but it keeps stating that the post is too long, any tips on how to fix it?



#5 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 26 November 2016 - 07:19 AM

Hi ZeSloth
 

I keep attempting to copy over the frst scan but it keeps stating that the post is too long, any tips on how to fix it?

This is fairly common with the 'main Frst' file..... it can be quite huge.

The answer in this case is to attach the file.
Instead of clicking on the 'Post' button .... click on More Reply Options.

attach_zpsmrynkv5p.png

On the next page, scroll down to the Attach Files section.

attach2_zpsy8kb5sk0.png

Click on the Browse button and navigate to the file that you want to attach.
Click on it to select and then click on the Attach this file button.
It will then be attached to your post.
Do this for the Main Frst file and then again for the Addition.txt.
When finished click on the Add Reply button.

BBPP6nz.png


#6 ZeSloth

ZeSloth
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 26 November 2016 - 07:22 AM

Cheers

Attached Files



#7 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 26 November 2016 - 02:17 PM

Hi ZeSloth

Sorry for the delay... sometimes it can take quite awhile to go through the reports properly.

Please take note of the following:

1. Please do not run any other tools unless instructed.
2. Please don't install or uninstall anything unless asked.
3. The cleaning process is not instant. Please continue to review my answers until I tell you that your computer is clean.
4. If there's anything that you don't understand, please ask your question(s) before proceeding with the fixes.
5. Please reply to this thread. Do not start a new topic.
6. Please follow steps in the correct order.


Step 1
It is not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:
1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.
Therefore please go to add/remove in the control panel and remove Kaspersky Anti-Virus.


Step 2
Please download the attached fixlist.txt file (bottom of this post) and save it to the Desktop.
NOTE.
It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system


Re-run FRST/FRST64 (which ever is installed ) and press the Fix button just once and wait.

frstfix_zps7db0c905.png

The tool will make a log on the Desktop (Fixlog.txt). Please post this in your next reply.



Step 3
Please download RogueKiller Anti-malware (Free) onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on RogueKiller Anti-malware to install the tool.
    Vista/Windows 7/8/10 users right-click and select Run As Administrator.
  • Select Accept the User Agreement then continue to click Next then finally click Install
  • Click Finish
    .
  • When the program opens..... click Scan

    rk1_zpsn7bfbew7.png
  • Click Start Scan

    rk2_zpszu8aygv0.png

    rk4_zpsj0fwsy1w.png
  • Double check anything found and tick to select items to be removed

    rk3_zps0k0uqbtb.png
  • Click Remove Selected
  • When the items have been removed.... Click Open Report >> Open TXT.
  • Copy and paste that report into your next reply.
In your next reply, please submit:
Fixlog.txt
RogueKiller report


Thanks.

Attached Files


Edited by Starbuck, 26 November 2016 - 02:17 PM.

BBPP6nz.png


#8 ZeSloth

ZeSloth
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 27 November 2016 - 04:50 AM

Hey thanks again for the assistance, attached are the files due to word limit.

 

ZeSloth

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-11-2016
Ran by Charlie (27-11-2016 20:17:50) Run:1
Running from C:\Users\Charlie\Desktop
Loaded Profiles: Charlie (Available Profiles: defaultuser0 & Charlie)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-4186191963-705699164-2115687276-1001\...\RunOnce: [Uninstall C:\Users\Charlie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Charlie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
ShellExecuteHooks:  - {5B3F609E-A5C1-11E6-A4FA-64006A5CFC23} - C:\Users\Charlie\AppData\Roaming\Redostherju\Djoentcgage.dll No File [ ]
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HomePage: ChromeDefaultData -> hxxp://www.google.com.au/
CHR StartupUrls: ChromeDefaultData -> "hxxp://www.google.com.au/","hxxp://www.trotux.com/?z=268ff24de1397e4707e8fdfg7z0mdtebco3gaofw8c&from=isr&uid=HitachiXHDS723020BLA642_MN1240FA15X3VD15X3VDX&type=hp"
CHR Profile: C:\Users\Charlie\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-11-26] <==== ATTENTION
2016-11-23 00:28 - 2016-11-23 00:28 - 00000000 ____D C:\ProgramData\Avira
2016-11-23 00:28 - 2016-11-23 00:28 - 00000000 ____D C:\ProgramData\Avg
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Charlie\AppData\Local\Temp\EslWireSetup-1.19.0.8229-x64.exe
C:\Users\Charlie\AppData\Local\Temp\vcredist_x64.exe
CustomCLSID: HKU\S-1-5-21-4186191963-705699164-2115687276-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-D65A124A622E}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
C:\Users\Charlie\AppData\Local\Temp\51A5.tmp.node
C:\Users\Charlie\AppData\Roaming\Redostherju
CMD: ipconfig /flushdns
EmptyTemp:
Hosts:


*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-4186191963-705699164-2115687276-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\Charlie\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64 => value removed successfully
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{5B3F609E-A5C1-11E6-A4FA-64006A5CFC23} => value removed successfully
"HKCR\CLSID\{5B3F609E-A5C1-11E6-A4FA-64006A5CFC23}" => key removed successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
Chrome HomePage => removed successfully
Chrome StartupUrls => removed successfully
C:\Users\Charlie\AppData\Local\Google\Chrome\User Data\ChromeDefaultData => moved successfully
C:\ProgramData\Avira => moved successfully
C:\ProgramData\Avg => moved successfully
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7370014.dll => moved successfully
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7380014.dll => moved successfully
C:\Users\Charlie\AppData\Local\Temp\drm_dyndata_7410004.dll => moved successfully
C:\Users\Charlie\AppData\Local\Temp\EslWireSetup-1.19.0.8229-x64.exe => moved successfully
C:\Users\Charlie\AppData\Local\Temp\vcredist_x64.exe => moved successfully
"HKU\S-1-5-21-4186191963-705699164-2115687276-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-D65A124A622E}" => key removed successfully
C:\Users\Charlie\AppData\Local\Temp\51A5.tmp.node => moved successfully
"C:\Users\Charlie\AppData\Roaming\Redostherju" => not found.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 599103 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 328257872 B
Java, Flash, Steam htmlcache => 210029043 B
Windows/system/drivers => 11417629 B
Edge => 18565080 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 16404 B
NetworkService => 4026 B
defaultuser0 => 128 B
Charlie => 1409593314 B

RecycleBin => 0 B
EmptyTemp: => 1.8 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 20:18:14 ====

 

RogueKiller V12.8.2.0 (x64) [Nov 21 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 10 (10.0.14393) 64 bits version
Started in : Normal mode
User : Charlie [Administrator]
Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Delete -- Date : 11/27/2016 20:21:57 (Duration : 00:18:13)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 12 ¤¤¤
[PUP] (X64) HKEY_USERS\RK_Client_ON_F_C564\Software\Softonic -> Deleted
[PUP] (X86) HKEY_USERS\RK_Client_ON_F_C564\Software\Softonic -> Deleted
[PUM.Proxy] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_D_0362\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) :   -> Deleted
[PUM.Proxy] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet002\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) :   -> Deleted
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet001\Services\Tcpip\Parameters\Interfaces\{97C846BD-D814-4AC0-9C8A-5D2F99FC929F} | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DE08115B-F9EC-4973-9AE3-96188FCC24E3} | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9af2b0fe-f2df-4ea8-852d-97eacf5dfbdb} | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet002\Services\Tcpip\Parameters\Interfaces\{97C846BD-D814-4AC0-9C8A-5D2F99FC929F} | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\RK_System_ON_F_8DC1\ControlSet002\Services\Tcpip\Parameters\Interfaces\{DE08115B-F9EC-4973-9AE3-96188FCC24E3} | DhcpNameServer : 10.0.0.138 ([])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 2 ¤¤¤
[PUP][Folder] C:\ProgramData\WinSAPSvc -> Deleted
[PUP][Folder] C:\ProgramData\WinSAPSvc -> ERROR [3]

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HDS723020BLA642 +++++
--- User ---
[MBR] ab0ab7250d5d4c3cd1b671b0c877082c
[BSP] b116329d76cbfa02bd5d8c20a4fe9f41 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 1907627 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: ST2000DM006-2DM164 +++++
--- User ---
[MBR] 7583e5ca17414e68ab672f1155307a2c
[BSP] 4498424e1e5ed1d16946cd13abab7e29 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive2: Samsung SSD 750 EVO 250GB +++++
--- User ---
[MBR] 15a0663ac1dbeb6be00cbd14bed19940
[BSP] d735ef22ef5467f7e04c7f4a8525642b : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1026048 | Size: 237973 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK
 

Attached Files


Edited by Starbuck, 27 November 2016 - 05:38 AM.


#9 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 27 November 2016 - 05:42 AM

Hi ZeSloth

I've added the reports for you.
It's easier to read them this way.

You stated originally......

Symptoms are:

-Pop ups everywhere

-Random downloaded applications

-Slow computer

-Windows defender scanning blocked

-Any malware removed through adwcleaner reappearing

-Chrome addons appearing

-Chrome redirects


How does the system compare now?
Any of these symptoms still exist?

BBPP6nz.png


#10 ZeSloth

ZeSloth
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:43 AM

Posted 27 November 2016 - 10:02 AM

Hey thanks for all your help! I think its fixed now, have not experienced any signs of malware, windows defender seems to be working again and chrome appears to be back to normal so I believe its all gone. Computer is much faster now, chrome actually loads most sites and my old extensions are working again.

 

Again thanks for the help, you guys here run a fantastic service to the pc community in assisting others with these kinds of problems.

 

Regards,

 

ZeSloth



#11 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 27 November 2016 - 01:24 PM

Hi ZeSloth,
 

have not experienced any signs of malware, windows defender seems to be working again and chrome appears to be back to normal so I believe its all gone. Computer is much faster now, chrome actually loads most sites and my old extensions are working again.

Thanks, that's good to hear. :)
 

Again thanks for the help, you guys here run a fantastic service to the pc community in assisting others with these kinds of problems.

Thank you for the kind words, it's appreciated.

Let's finish the cleaning process and remove the tools we have used.

Step 1
Restart MBAM.
Click on the History tab >> Quarantine
Tick to select all items (if any there ) and then click the Delete button.
Close MBAM.

Step 2
FRST can now be removed:

Right click on the FRST icon and select delete.
Right click on any Frst.txt, fixlog.txt or fixlist.txt files and select delete.
Navigate to: C:\frst and delete the frst folder

Step 3
RogueKiller AntiMalware can be uninstalled from the uninstall list: (if you want to remove it )

Win7:
Click the Start button >> Control Panel >> Programs >> Programs and Features.

Win8:
Right click on the Start button >> select Programs and Features

Win10:
Right click on the Start button >> select Programs and Features

Step 4
If still on your system... the following programs can also be removed now:

Hitman Pro... can be uninstalled from the uninstall list:
AdwCleaner... Start AdwCleaner, click on File button and then click on Uninstall.


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Use an AntiVirus Software

Only install one AntiVirus program at a time

Use a Firewall

Only install one software Firewall

Scan regularly with a 'Stand Alone' Anti-Malware scanner:
Installing another scanner that you can run once or twice a week is always beneficial.
Something like:Remember to update these programs each time before running.
You can install more than one of these if you only run them as stand alone programs.

Install an AdBlocker
Firefox: uBlock Origin
Google Chrome: uBlock Origin

uBlock Origin is NOT an "ad blocker" as such: it is a wide-spectrum blocker -- which happens to be able to function as a mere "ad blocker".
The default behavior of uBlock Origin when newly installed is to block ads, trackers and malware sites
.

Internet Explorer:
Adblock Plus for Internet Explorer

P2P programs/Torrents
Don't be tempted to use Peer to Peer programs.
Many of the downloads are bundled with malware.

Beware of PuP's when installing 'free' software
(Potentially Unwanted Program) An application that is installed along with the desired application the user actually asked for.
In most cases, the PUP is spyware, adware or some other unwanted software.
However, what makes spyware or adware a PUP rather than pure malware is the fact that the end user license agreement (EULA) does inform the user that this additional program is being installed.
Considering hardly anyone ever reads the license agreement, the distinction is a subtle one.

Understanding PuP's (Adware)


Update all your 'Security' programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Safe surfing. Computer_addict__by_Sinister_Starfeesh.g

Edited by Starbuck, 27 November 2016 - 01:25 PM.

BBPP6nz.png


#12 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:43 PM

Posted 29 November 2016 - 12:39 PM

As this topic has been resolved this thread will now be closed.

If you need this topic reopened, please contact one of the moderating team by PM and we will reopen it for you.
Include the address of this thread in your request.
If you should have a new issue, please start a new topic.
This applies only to the original topic starter.

Everyone else please begin a New Topic.

BBPP6nz.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users