• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
dryden28

redirected to Suggestsnow.com

9 posts in this topic

Hi guys,

 

Everytime i perform a google search, it redirects me to "Suggestsnow.com" I've tried running NIS 2010 and spyware doctor but so far no luck. If you guys can help at all it would be very much appreciated. sorry if i have post on the wrong place

 

This is my Hijackthis log file:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:39:34 AM, on 27/11/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18294)

Boot mode: Normal

 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\TUProgSt.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Windows\ehome\ehsched.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\ehome\EHTray.exe

E:\Program Files\BitComet\BitComet.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\wbem\wmiprvse.exe

 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - e:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

O4 - HKLM\..\Run: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - (no file)

O9 - Extra button: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O13 - Gopher Prefix:

O15 - ESC Trusted Zone: http://*.update.microsoft.com

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

 

--

End of file - 6469 bytes

Edited by dryden28

Share this post


Link to post
Share on other sites

Hi,

I'm nasdaq and will be helping you.

 

Print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.

 

Nothing suspicious was found on your log.

 

Please download GooredFix and save it to your Desktop.

 

Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt). Note: Do not run Option #2 yet.

 

p.s. On a Vista computer right-click and select Run As Administrator.

 

GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

 

Let me know if the redirections are also happening in Internet Explorer.

Share this post


Link to post
Share on other sites

Yes, i'm also re-directed on IE

 

Here is the log for Gooredfix

 

GooredFix by jpshortstuff (27.11.09.1)

Log created at 07:06 on 29/11/2009 (Kian Hui)

Firefox version 3.5.5 (en-GB)

 

========== GooredScan ==========

 

 

========== GooredLog ==========

 

C:\Program Files\Mozilla Firefox\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd} [15:25 13/08/2009]

{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [17:10 21/08/2009]

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [23:03 28/08/2009]

 

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"{20a82645-c095-46ed-80e3-08825760534b}"="C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [22:12 30/07/2009]

"{BBDA0591-3099-440a-AA10-41764D9DB4DB}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\" [19:02 25/11/2009]

"{4C0766D3-67A7-45a3-85A2-752F77312F32}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\" [19:02 25/11/2009]

 

-=E.O.F=-

Share this post


Link to post
Share on other sites

Download ComboFix from any of the links below, and save it to your desktop. For information regarding this download, please visit this web page: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

 

Link 1

Link 2

 

 

**Note: It is important that it is saved directly to your desktop**

 

--------------------------------------------------------------------

 

1. Close any open browsers.

 

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

 

3. Do not install any other programs until this if fixed.

--------------------------------------------------------------------

 

Double click on ComboFix.exe & follow the prompts.

  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new HijackThis log for further review.

Note:

Do not mouse click combofix's window while it's running. That may cause it to stall

Share this post


Link to post
Share on other sites

This is may new hijackthis log:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:47:16 AM, on 30/11/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18294)

Boot mode: Normal

 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\TUProgSt.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

C:\Windows\system32\DllHost.exe

C:\Windows\explorer.exe

C:\Windows\system32\conime.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - e:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\IPSBHO.DLL

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\coIEPlg.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

O4 - HKLM\..\Run: [skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - (no file)

O9 - Extra button: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (no file)

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://E:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O15 - ESC Trusted Zone: http://*.update.microsoft.com

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

 

--

End of file - 5592 bytes

 

 

This is the combo fix log:

 

ComboFix 09-11-29.02 - Kian Hui 1/2009 Mon 7:31.1.2 - x86

Running from: c:\users\Kian Hui\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

* Created a new restore point

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected

Restored copy from - Kitty ate it :p

.

((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))

.

 

2009-11-29 23:40 . 2009-11-29 23:41 -------- d-----w- c:\users\Kian Hui\AppData\Local\temp

2009-11-29 23:40 . 2009-11-29 23:40 -------- d-----w- c:\users\Default\AppData\Local\temp

2009-11-29 16:18 . 2009-11-25 19:04 2747952 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\CCERASER.DLL

2009-11-29 16:18 . 2009-11-25 19:04 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\ECMSVR32.DLL

2009-11-29 16:18 . 2009-08-29 09:00 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\NAVENG.SYS

2009-11-29 16:18 . 2009-08-29 09:00 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\EECTRL.SYS

2009-11-29 16:18 . 2009-08-29 09:00 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\NAVENG32.DLL

2009-11-29 16:18 . 2009-08-29 09:00 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\NAVEX32A.DLL

2009-11-29 16:18 . 2009-08-29 09:00 1323568 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\NAVEX15.SYS

2009-11-29 16:18 . 2009-08-29 09:00 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20091129.002\ERASER.SYS

2009-11-27 14:24 . 2009-11-27 15:36 8192 d-----w- c:\program files\WuLin

2009-11-26 20:39 . 2009-11-26 20:39 -------- d-----w- c:\program files\Trend Micro

2009-11-25 23:00 . 2009-11-25 23:00 -------- d-----w- c:\users\Kian Hui\AppData\Local\Tific

2009-11-25 23:00 . 2009-11-25 23:00 -------- d-----w- c:\users\Kian Hui\AppData\Roaming\Tific

2009-11-25 21:42 . 2009-11-25 21:42 604488 ----a-w- c:\windows\system32\TUProgSt.exe

2009-11-25 21:42 . 2009-11-16 11:25 17224 ----a-w- c:\windows\system32\authuitu.dll

2009-11-25 21:42 . 2009-11-16 11:25 29000 ----a-w- c:\windows\system32\uxtuneup.dll

2009-11-25 21:42 . 2009-11-25 21:42 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe

2009-11-25 19:49 . 2009-11-29 13:59 4096 d-----w- c:\users\Kian Hui\AppData\Local\CrashDumps

2009-11-25 19:45 . 2009-10-10 23:51 44080 ----a-r- c:\windows\system32\drivers\SymIMV.sys

2009-11-25 19:04 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\Scxpx86.dll

2009-11-25 19:04 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\IDSvix86.sys

2009-11-25 19:04 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\IDSXpx86.sys

2009-11-25 19:04 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\IDSxpx86.dll

2009-11-25 19:04 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\IDSviA64.sys

2009-11-25 19:02 . 2009-10-29 02:31 784752 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll

2009-11-25 18:56 . 2009-11-25 23:00 932208 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\OCS\hsplayer.dll

2009-11-25 18:56 . 2009-08-30 00:16 164216 ----a-r- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll

2009-11-25 18:56 . 2009-09-01 08:48 893296 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\CLT\cltLMSx.dll

2009-11-25 06:05 . 2009-11-25 06:05 -------- d-----w- c:\users\Kian Hui\AppData\Local\ICS

2009-11-23 02:55 . 2009-11-23 02:55 -------- d-----w- c:\users\Kian Hui\AppData\Roaming\Ubisoft

2009-11-23 02:55 . 2009-11-23 02:55 -------- d-----w- c:\programdata\Ubisoft

2009-11-15 07:45 . 2009-11-15 07:45 -------- d-----w- c:\program files\Call of Duty Modern Warfare 2 - No-DVD Working Crack

2009-11-15 07:03 . 2009-11-15 07:03 -------- d-----w- c:\program files\Activision

2009-11-04 23:50 . 2009-11-04 23:50 201616 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\BHRules.dll

2009-11-04 23:50 . 2009-11-04 23:50 663088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\BHDrvx64.sys

2009-11-04 23:50 . 2009-11-04 23:50 524848 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\BHDrvx86.sys

2009-11-04 23:50 . 2009-11-04 23:50 1413520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\BHEngine.dll

2009-11-04 23:50 . 2009-11-04 23:50 610704 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\bbRGen.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-25 21:41 . 2009-08-16 07:07 49152 d-----w- c:\program files\TuneUp Utilities 2009

2009-11-25 18:57 . 2009-07-30 22:35 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2009-11-25 18:57 . 2009-07-30 22:35 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2009-11-25 18:57 . 2009-07-30 22:35 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2009-11-25 18:57 . 2009-07-30 22:35 -------- d-----w- c:\program files\Symantec

2009-11-25 18:56 . 2009-07-30 20:37 4096 d-----w- c:\programdata\Norton

2009-11-25 18:56 . 2009-07-30 20:36 -------- d-----w- c:\programdata\NortonInstaller

2009-11-25 05:49 . 2009-09-25 06:30 40960 d-----w- c:\program files\Spyware Doctor

2009-11-12 22:30 . 2009-07-30 20:42 4096 d--h--w- c:\program files\InstallShield Installation Information

2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSvix86.sys

2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSXpx86.sys

2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\Scxpx86.dll

2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSxpx86.dll

2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\BinHub\IDSviA64.sys

2009-10-28 07:47 . 2009-10-28 07:47 4096 d-----w- c:\program files\pcsx2-r1888

2009-10-25 07:11 . 2009-10-25 07:11 652296 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsTemplate\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll

2009-10-25 07:10 . 2009-10-25 07:10 746760 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-10-25 07:10 . 2009-10-25 07:10 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll

2009-10-23 04:04 . 2009-10-23 03:50 -------- d-----w- c:\users\Kian Hui\AppData\Roaming\DAEMON Tools Lite

2009-10-23 04:03 . 2009-10-23 04:03 -------- d-----w- c:\programdata\DAEMON Tools Lite

2009-10-23 04:03 . 2009-10-23 04:03 -------- d-----w- c:\program files\DAEMON Tools Toolbar

2009-10-23 04:03 . 2009-10-23 04:03 4096 d-----w- c:\program files\DAEMON Tools Lite

2009-10-23 03:56 . 2009-10-23 03:56 680 ----a-w- c:\users\Kian Hui\AppData\Local\d3d9caps.dat

2009-10-23 03:51 . 2009-10-23 03:51 721904 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-10-23 03:47 . 2009-07-30 20:41 -------- d-----w- c:\program files\Common Files\InstallShield

2009-10-21 07:05 . 2009-07-30 20:43 -------- d-----w- c:\program files\ATI

2009-10-21 07:05 . 2009-10-21 07:05 -------- d-----w- c:\programdata\ATI

2009-10-21 06:50 . 2009-07-30 20:43 -------- d-----w- c:\program files\ATI Technologies

2009-10-21 06:47 . 2009-10-21 06:47 10134 ----a-r- c:\users\Kian Hui\AppData\Roaming\Microsoft\Installer\{A7E110EF-3B05-4CCD-3CB7-3D373325D43A}\ARPPRODUCTICON.exe

2009-10-14 03:46 . 2009-07-30 21:45 4096 d-----w- c:\program files\Microsoft Silverlight

2009-10-13 15:35 . 2009-10-13 15:29 -------- d-----w- c:\program files\Microsoft

2009-10-13 15:34 . 2009-10-13 15:34 4096 d-----w- c:\program files\Microsoft Office Outlook Connector

2009-10-13 15:34 . 2009-07-30 21:44 4096 d-----w- c:\program files\Windows Live

2009-10-13 15:33 . 2009-10-13 15:33 -------- d-----w- c:\program files\Microsoft Sync Framework

2009-10-13 15:31 . 2009-10-13 15:31 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2009-10-13 15:29 . 2009-10-13 15:29 -------- d-----w- c:\program files\Windows Live SkyDrive

2009-10-05 10:19 . 2009-10-05 10:19 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE

2009-09-30 18:13 . 2009-09-08 17:45 99864 ----a-w- c:\users\Kian Hui\AppData\Local\GDIPFONTCACHEV1.DAT

2009-09-25 06:38 . 2009-09-25 06:30 206256 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-09-25 05:46 . 2009-09-25 05:45 164 ----a-w- c:\windows\install.dat

2009-09-23 03:48 . 2009-09-23 03:48 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2009-09-11 11:53 . 2009-08-21 07:20 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2009-09-11 11:53 . 2009-08-21 07:20 109080 ----a-w- c:\windows\system32\OpenAL32.dll

2009-09-04 09:44 . 2009-10-05 10:12 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2009-09-04 09:44 . 2009-10-05 10:12 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2009-09-04 09:44 . 2009-10-05 10:12 238936 ----a-w- c:\windows\system32\xactengine3_5.dll

2009-09-04 09:29 . 2009-10-05 10:12 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2009-09-04 09:29 . 2009-10-05 10:12 235344 ----a-w- c:\windows\system32\d3dx11_42.dll

2009-09-04 09:29 . 2009-10-05 10:12 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll

2009-09-04 09:29 . 2009-10-05 10:12 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll

2009-09-04 09:29 . 2009-10-05 10:12 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2009-09-02 06:49 . 2009-09-02 06:38 0 ---h--w- c:\programdata\PKP_DLdu.DAT

2009-09-02 06:38 . 2003-03-19 04:05 106496 ----a-w- c:\windows\system32\ATL71.DLL

2008-09-28 01:39 . 2008-09-28 01:39 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

.

 

------- Sigcheck -------

 

[-] 2009-08-21 . A2AA23A716A9CAF4D418F8DA55257C9C . 882144 . . [6.0.6001.18063] . . c:\windows\System32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun" [X]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-07-06 1833504]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.exe

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ehTray.exe"=c:\windows\ehome\ehTray.exe

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" /hide

"MacroMachine BootMark"=c:\program files\Tronan\MacroMachine\BootMark.exe

 

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [25/9/2009 2:30 PM 206256]

R0 SymDS;Symantec Data Store;c:\windows\System32\drivers\NIS\1101000.013\SymDS.sys [26/11/2009 3:50 AM 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\System32\drivers\NIS\1101000.013\SymEFA.sys [26/11/2009 3:50 AM 171056]

R1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20091104.001\BHDrvx86.sys [5/11/2009 7:50 AM 524848]

R1 ccHP;Symantec Hash Provider;c:\windows\System32\drivers\NIS\1101000.013\cchpx86.sys [26/11/2009 3:50 AM 501888]

R1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20091111.001\IDSvix86.sys [26/11/2009 3:04 AM 343088]

R1 SymIRON;Symantec Iron Driver;c:\windows\System32\drivers\NIS\1101000.013\Ironx86.sys [26/11/2009 3:50 AM 114736]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\drivers\NIS\1101000.013\symtdiv.sys [26/11/2009 3:50 AM 339504]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\System32\atiesrxx.exe [14/8/2009 10:15 AM 172032]

R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [26/11/2009 3:50 AM 126392]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [25/9/2009 12:00 AM 102448]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [25/9/2009 2:30 PM 348752]

S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [23/10/2009 11:51 AM 721904]

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

 

2009-11-29 c:\windows\Tasks\1-Click Maintenance.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 15:43]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Kian Hui\AppData\Roaming\Mozilla\Firefox\Profiles\kxoxayxb.default\

FF - prefs.js: browser.startup.homepage - www.google.com

FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll

FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

 

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-30 07:40

Windows 6.0.6001 Service Pack 1 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"

.

Completion time: 2009-11-30 07:43

ComboFix-quarantined-files.txt 2009-11-29 23:43

 

Pre-Run: 49,582,465,024 bytes free

Post-Run: 49,532,317,696 bytes free

 

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4

- - End Of File - - 143CAC3EB43AF2A2B5760CF0D2776A43

Edited by dryden28

Share this post


Link to post
Share on other sites

Looking good.

 

Lets find out if you have a good copy of this tcpip.sys file.

 

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy and paste the content of the following bold text into the main textfield:
     

    :filefind
    tcpip.sys

     
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

Please let me know if the redirections are still happening.

Share this post


Link to post
Share on other sites

Hi, this is my systemlook log file:

 

SystemLook v1.0 by jpshortstuff (29.08.09)

Log created at 08:06 on 01/12/2009 by Kian Hui (Administrator - Elevation successful)

 

========== filefind ==========

 

Searching for "tcpip.sys"

C:\Windows\System32\drivers\tcpip.sys --a--- 882144 bytes [01:55 28/09/2008] [17:01 21/08/2009] A2AA23A716A9CAF4D418F8DA55257C9C

C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_b31e1252666640f6\tcpip.sys --a--- 891448 bytes [02:25 21/01/2008] [02:25 21/01/2008] FC6E2835D667774D409C7C7021EAF9C4

C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys --a--- 891448 bytes [01:55 28/09/2008] [01:55 28/09/2008] 82E266BEE5F0167E41C6ECFDD2A79C02

C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22167_none_b36dd19b7fae39c7\tcpip.sys --a--- 891448 bytes [01:55 28/09/2008] [01:55 28/09/2008] 01EC1E92595F839BEE70D439C46796E3

 

-=End Of File=-

 

I'm no longer being re-directed anymore... thx a million

Share this post


Link to post
Share on other sites

Open notepad and copy/paste the text in the quote box below into it:

 

FCOPY::
C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18063_none_b2e033a8669434a1\tcpip.sys | C:\Windows\System32\drivers\tcpip.sys

 

Save this as CFScript on your desktop.

 

CFScriptB-4.gif

 

Referring to the picture above, drag CFScript into ComboFix.exe. Please post the resultant log.

Share this post


Link to post
Share on other sites

Glad we could help. :)

 

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0