1.11M Members

I've got Trojan.Holax... is this bad?

 
0
 

Any of ye caped crusader's able to help me out here? Norton anti virus told me Ive got this trojan but didn't seem to be able to do anything about it. It's Lurking around in MESSENGER\MSMSGS.EXE. Please tell me this is easier to cure than blooming spyware! :confused:

 
0
 

Go
Here
and Get Trojan-Hunter Fully working trial!
,,,,,,,,,,,,,,,,,,,,,,,,,,
Please download and run Adaware & Spybot Then follow the instructions in the link below to run.

Spybot Tutorial

AdAware Tutorial

Step # 2

Please do an online scan, 2 would be better,

Trend Micro http://housecall.trendmicro.com/
Microworld http://www.mwti.net/antivirus/free_utilities.asp

Make sure that you choose "fix" or "clean".


Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

 
0
 

Ay up Caperjack! Thanks for getting on my case... Did what you said there and here's' the results with a bit of additional info which may help muddy the waters somewhat.

The original warnings from Norton Antivirus told me that my computer was infected here (3 separate warnings after reboots):

C:\PROGRAM FILES\MESSENGER\MSMSGS.EXE

C:\Program files\Compaq\EasyAccess button...\StartEAK.exe

C:Program files\Common Files\Microsoft Shar...\wkcalrem.exe

Oddly enough all of these have tried to get internet access recently and I probably let them before the warnings :o

Anyway here's what eScan had to say for itself

File C:\WINDOWS\System32\ms0b920b.dll infected by "not-a-virus:AdWare.Visiter" Virus. Action Taken: No Action Taken.

File C:\Documents and Settings\ebennew\My Documents\Mr Migmam's woobly dangly bits\EasyDivX DVD ripper\softs\ck.exe tagged as not-a-virus:Tool.Win32.Pcwelt.a. No Action Taken.

File C:\EasyDivX\softs\ck.exe tagged as not-a-virus:Tool.Win32.Pcwelt.a. No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\3B077742.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\4CBF45C3.EXE infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\4D734AFD.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\4D8072EF.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\4DBA66AE.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\Program Files\Norton AntiVirus\Quarantine\66111C09.EXE infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP2\A0000113.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018367.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018376.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018377.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018400.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018401.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018402.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018403.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\System Volume Information\_restore{8238BFE6-44BD-4B25-B0F7-CE65B3815CC9}\RP29\A0018405.exe infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.

File C:\WINDOWS\system32\ms0b920b.dll infected by "not-a-virus:AdWare.Visiter" Virus. Action Taken: No Action Taken.

And here you'll be delighted to see is my latest HJT log:

Logfile of HijackThis v1.99.0
Scan saved at 00:04:54, on 23/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Winamp\Winampa.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\internet security suite\really new hijack this\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~2\Office\1033\phdintl.dll/phdContext.htm
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Is any of this left over from my old spyware problem? (which never completely resolved itself)

I just use Firefox now but every few boots IE tries to access the net and if I deny it access (with ZONEALARM) I get 70 odd internet exploder windows open by themselves resulting in a crash.

Thanks in advance for saving my posterior agin. Say Hi to the Wombat for me...

Go raibh mile maith agat agus slan!

 
0
 

PS is " FindHolax" going to be any help here?

 
0
 

AHAAAAGH! I've been doing a bit of rresearch and found INetDoor in my add/remove programs bit... This is significant, I spose. Given that Symantec Net Detect is probably now infected along with nearly all my start up programs, how am i going to repair everything even if i can get rid of the Inetdoor thing? Ooer...

 
0
 

Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-


http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT/tsgen...001052409420406

 
0
 

I found some info here .
http://computercops.biz/postitle94182-0-0-.html
and this is why i suggest cwshredder .
http://www.doxdesk.com/parasite/CoolWebSearch.html

And most of the info in you Escan the files are in quarentene or in you system restore . you will need to turn off system restore after you run cwshredder .untill you get it all cleaned up .

 
0
 

Ay up Caperjack! Thanks for the helpful links there. It looks like this thing is beatable.

One thing worrying me is that I don't have the Windows Installation disks, everything came installed on the computer. So if I drop in the dummy dll then uninstall all the infected startups I won't be able to re install messenger for example, live update etc. or will I? I'm a NOVICE to say the least and don;t want a computer with psychological problems...

 
0
 

I'm a NOVICE too!so i really cant answer that !
but first did you try CWShredder to see if it helps .

 
0
 

What have you done with all the infected files from post #3? They all need to be deleted. The system restore can probably wait until you are clean as the only way the ones in the restore folder can affect your PC is if you do a system restore :).

Download sysclean (free) from Trend Micro, allow it to clean up any bad files it finds. It may take a while, so have a cuppa whilst it's running :).

http://www.trendmicro.com/download/dcs.asp

Be sure to download and install the latest pattern file. There's a link to it at the lower left-hand colum of the page. It will not run without the pattern file.

From Trend:

Note that for the Trend Micro Sysclean Package to be effective, you must download and place the latest pattern file in the same folder as the Trend Micro Sysclean Package.

 
0
 

I haven't deleted anything yet because I can't reinstall any windows components that have been infected... CWShredder (new vwersion says I'm squeeky clean but I'm not eh?)

 
0
 


Download sysclean (free) from Trend Micro, allow it to clean up any bad files it finds. It may take a while, so have a cuppa whilst it's running :).

http://www.trendmicro.com/download/dcs.asp

HA HA! I've been out and made a full roast dinner and it's only just finished!!!
:lol: Anyway here's what its log says:

/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/


2005-01-23, 15:45:40, Auto-clean mode specified.
2005-01-23, 15:45:40, Running scanner "C:\Program Files\internet security suite\sysclean\TSC.BIN"...
2005-01-23, 15:45:59, Scanner "C:\Program Files\internet security suite\sysclean\TSC.BIN" has finished running.
2005-01-23, 15:45:59, TSC Log:

Damage Cleanup Engine (DCE) 3.9(Build 1020)
Windows XP(Build 2600: )

Start time : Sun Jan 23 2005 15:45:42

Load Damage Cleanup Template (DCT) "C:\Program Files\internet security suite\sysclean\tsc.ptn" (version 487) [success]

Complete time : Sun Jan 23 2005 15:45:59
Execute pattern count(1749), Virus found count(0), Virus clean count(0), Clean failed count(0)

2005-01-23, 16:00:38, An error occurred while scanning file "C:\Documents and Settings\ebennew\NTUSER.DAT": Access is denied.
2005-01-23, 16:00:38, An error occurred while scanning file "C:\Documents and Settings\ebennew\ntuser.dat.LOG": Access is denied.
2005-01-23, 16:01:01, An error occurred while scanning file "C:\Documents and Settings\ebennew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2005-01-23, 16:01:01, An error occurred while scanning file "C:\Documents and Settings\ebennew\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2005-01-23, 16:32:52, An error occurred while scanning file "C:\Documents and Settings\LocalService\NTUSER.DAT": Access is denied.
2005-01-23, 16:32:52, An error occurred while scanning file "C:\Documents and Settings\LocalService\ntuser.dat.LOG": Access is denied.
2005-01-23, 16:32:53, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat": Access is denied.
2005-01-23, 16:32:53, An error occurred while scanning file "C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG": Access is denied.
2005-01-23, 17:19:11, Could not set file for reading on "C:\WINDOWS\$NtUninstallQ307969$\parport.sys": Access is denied.
2005-01-23, 17:19:11, Could not set file for reading on "C:\WINDOWS\$NtUninstallQ307969$\spuninst\spuninst.exe": Access is denied.
2005-01-23, 17:19:11, Could not set file for reading on "C:\WINDOWS\$NtUninstallQ307969$\spuninst\spuninst.inf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\ACRORD32.EXE-0781811F.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AD-AWARE.EXE-2ED3360E.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\ADOBE GAMMA LOADER.EXE-1DBD7BA3.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AGENTSVR.EXE-002E45AB.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AUPATCH.DAT-26B17925.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AUPDATE.EXE-2253CB60.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AUUNZIP.DAT-0F430B30.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\AUUPDATE.DAT-1C26048B.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\BTTNSERV.EXE-156C663E.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\CCLEANER.EXE-0BCE437C.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\CLICAPI20.EXE-0884FF61.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\CPQEADM.EXE-01DAFE68.pf": Access is denied.
2005-01-23, 17:22:39, Could not set file for reading on "C:\WINDOWS\Prefetch\CPQEAKSYSTEMTRAY.EXE-02AC468C.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\CSRSS.EXE-12B63473.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\CWSHREDDER.EXE-075D6433.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\CWSHREDDER.EXE-1530D436.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DIRECTCD.EXE-0A60B47C.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DISREB~1.EXE-116A29FD.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DRWTSN32.EXE-2B4B52AC.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\EAUSBKBD.EXE-0920B492.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\ESCNDV.EXE-2FFF20EB.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\FIND.EXE-0EC32F1E.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\FIREFOX.EXE-17EE503B.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\FIREFOX.EXE-28641590.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\GETVLIST.EXE-3374D9AD.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HH.EXE-2D1A70B3.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-0E1BF781.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HIJACKTHIS.EXE-39DC3871.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HPGS2WND.EXE-06AC8C27.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HPGS2WNF.EXE-3A8D0447.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\HPW8TBX.EXE-07B56719.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\INSTALL.EXE-3AEF1D3F.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\JUSCHED.EXE-1E31B7EA.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\KAVSS.EXE-0634462E.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\Layout.ini": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LSETUP.EXE-34E1AE91.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LUALL.EXE-30AC8E48.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LUCOMS~1.EXE-02DB5950.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LUSETUP-LT.EXE-1D0507C4.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LUSETU~1.EXE-1F968773.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\LUUPDATE.EXE-057DD85A.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\MSIMN.EXE-38BA891D.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\MSMSGS.EXE-2B6052DE.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\MWAV.EXE-02FBCF70.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\MWAVSCAN.COM-2F443510.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NAVAPW32.EXE-14F0BD2A.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NAVW32.EXE-24F56911.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NAVW32.EXE-2F9B64D1.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NDETECT.EXE-16E64095.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NMAIN.EXE-2BA406E0.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NOTEPAD.EXE-189578DA.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\OSA9.EXE-27CD7DB8.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\OUTLOOK.EXE-3784AE71.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\PATCH.EXE-1DE617D3.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\QSERVER.EXE-22A02121.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\QTTASK.EXE-342507FB.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\REALPLAY.EXE-1BF219BD.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RL.EXE-0EB8DE0F.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-14948BEB.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-18E3301D.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-1C320F03.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-268BFF96.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-37AF1B57.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-4743EFC7.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SETHOOK.EXE-3556B5A6.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SETREFRESH.EXE-0C1D851C.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SMTRAY.EXE-025A616B.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SNDMON.EXE-0A6C21A2.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SPYBOTSD.EXE-1344276B.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SPYWAREBLASTER.EXE-20CF1E62.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SRMCLEAN.EXE-1A445B2C.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SSTEXT3D.SCR-17B3B9DD.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\STARTEAK.EXE-02E55F96.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SYMANT~1.EXE-0325DF9A.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SYMWSC.EXE-321AAE19.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSCLEAN.COM-1D1BBD47.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSCLEAN.EXE-07354F67.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\TSC.BIN-38462285.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\TSC.EXE-2B4C0858.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\UPDATE.EXE-1E8AE159.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\VSMON.EXE-1609C098.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINAMPA.EXE-0536E33F.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINLOGON.EXE-32C57D49.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINPATROL.EXE-0E9A04D5.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINPATROLEX.EXE-29896382.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINWORD.EXE-29F5CB89.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WINZIP32.EXE-335422C1.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WKCALREM.EXE-23DFAF4B.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WKDETECT.EXE-317B1611.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WKSCAL.EXE-10AB18FB.pf": Access is denied.
2005-01-23, 17:22:40, Could not set file for reading on "C:\WINDOWS\Prefetch\WKSSB.EXE-01DCAEEA.pf": Access is denied.
2005-01-23, 17:22:41, Could not set file for reading on "C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf": Access is denied.
2005-01-23, 17:22:41, Could not set file for reading on "C:\WINDOWS\Prefetch\WMPLAYER.EXE-18DDEF9C.pf": Access is denied.
2005-01-23, 17:22:41, Could not set file for reading on "C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf": Access is denied.
2005-01-23, 17:22:41, Could not set file for reading on "C:\WINDOWS\Prefetch\ZLCLIENT.EXE-1C550EB2.pf": Access is denied.
2005-01-23, 17:27:11, An error occurred while scanning file "C:\WINDOWS\system32\config\DEFAULT": Access is denied.
2005-01-23, 17:27:11, An error occurred while scanning file "C:\WINDOWS\system32\config\default.LOG": Access is denied.
2005-01-23, 17:27:11, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM": Access is denied.
2005-01-23, 17:27:11, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM.LOG": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY.LOG": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\SOFTWARE": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\software.LOG": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\SYSTEM": Access is denied.
2005-01-23, 17:27:12, An error occurred while scanning file "C:\WINDOWS\system32\config\system.LOG": Access is denied.
2005-01-23, 17:28:59, An error occurred while scanning file "C:\WINDOWS\Temp\ZLT03f74.TMP": Access is denied.
2005-01-23, 17:29:06, Running scanner "C:\Program Files\internet security suite\sysclean\VSCANTM.BIN"...
2005-01-23, 18:20:45, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/23/2005 17:29:10
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 365 (86521 Patterns) (2005/01/21) (236500)
Command Line: C:\Program Files\internet security suite\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Program Files\internet security suite\sysclean

C:\WINDOWS\system32\ms0b920b.dll [TROJ_HOLAX.A]
56274 files have been read.
56274 files have been checked.
41219 files have been scanned.
224346 files have been scanned. (including files in archived)
1 files containing viruses.
Found 1 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/23/2005 18:20:45
---------*---------*---------*---------*---------*---------*---------*---------*
2005-01-23, 18:20:45, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/23/2005 17:29:09
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 365 (86521 Patterns) (2005/01/21) (236500)
Command Line: C:\Program Files\internet security suite\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Program Files\internet security suite\sysclean

Success Clean [ TROJ_HOLAX.A]( 1) from C:\WINDOWS\system32\ms0b920b.dll
56274 files have been read.
56274 files have been checked.
41219 files have been scanned.
224346 files have been scanned. (including files in archived)
1 files containing viruses.
Found 1 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/23/2005 18:20:45 51 minutes 34 seconds (3094.05 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-01-23, 18:20:45, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/23/2005 17:29:09
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 365 (86521 Patterns) (2005/01/21) (236500)
Command Line: C:\Program Files\internet security suite\sysclean\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Program Files\internet security suite\sysclean

56274 files have been read.
56274 files have been checked.
41219 files have been scanned.
224346 files have been scanned. (including files in archived)
1 files containing viruses.
Found 1 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/23/2005 18:20:45 51 minutes 34 seconds (3094.05 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2005-01-23, 18:20:45, Scanner "C:\Program Files\internet security suite\sysclean\VSCANTM.BIN" has finished running.

I'm still worried about restoring the missing bits of the affected startups now that the ms0b920b has been deleted. If I shut down my computer now will it all go pear shaped on reboot?... I'm scared...

Go raibh maith agat, dudes

 
0
 

Now that it's gone I think your only option is to go ahead and clean out the prefetch folder and to also do the following;

Clear out your Temporary internet files and other temp files.
Go to Start > Settings > Control Panel >Internet Options.

Under the General tab click the Delete temporary internet files,
delete all Offline content as well. Clear out Cookies.

Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

This one too if Win2K or XP.
C:\Documents and Settings\username\Local Settings\Temp\

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Empty the Recycle Bin.

Which components do you believe to be missing?
I'm off to work now so will have to reply later in the day, unless one of our other members chips in :D.

 
0
 

Ay up Crunchie and Caperjack and any other of you public spirited nutters!

Before your last post I got very worried about simply removing the ms0b929b.dll with the antivirus... so I did a system restore to before what I did in post 12. Don't freak out! (well not yet anyway)

I checked out Caperjack's link to doxdesk and this is what got me worried, so I followed these instructions...

InetDoor variant

Unless you have an anti-virus program that specifically knows how to remove the import table entries from startup programs affected by InetDoor, removal is difficult. You can delete the file, but then any of the affected programs will refuse to run.

A short term workaround is to replace the InetDoor DLL with a dummy version that does nothing. You can then uninstall and reinstall each program with a component set to run on startup.

To do this, download InetDummy.dll and restart the computer in Safe Mode. To get the menu for Safe Mode, press F8 just as Windows starts to boot — on the NT boot loader menu if you have one, else just hammer it as the computer starts up.

Open the System32 folder (inside the Windows folder; called just ‘System’ on Windows 95/98/Me) and find the InetDoor file. It will be called msNNNNNN.dll, where NNNNNN is a six-digit hexadecimal number. There will also be .cfg and .da0 files with the same name.

Rename msNNNNNN.dll to msNNNNN.bak, then drop the InetDummy.dll file into this folder and rename it msNNNNNN.dll (the same name as the original DLL). Reboot the computer and if all goes well you can delete msNNNNNN.bak, .cfg and .da0.

This hasn't presented any problems yet but I know that some of my start up programs have been altered. Mesenger still asks for access to the internet along with IE (even though I only use Firefox) and Norton Integrator. I don't know which of them to trust so I'm denying them all...

Am I going to have to uninstall and reinstall evrything on the start up list?

Go raibh maith agat! Slan!

 
0
 

Oh Pants!

I just reresd the bit about not doing a system restore before removing the other viruses in post 3 ...

Lads... sorry... It's late and I've spent too long trying to work this out my brains are small and smelly. I'm not gonna touch a thing till I hear from ye again..

Slan!

 
0
 

How about doing a restore back to a time that you consider to be when your PC was doing well? But not too far that you lose any information or programs that you may need.
Then hit msconfig for a normal startup, reboot and post another log :).

 
0
 

This is very effective:
Run msconfig;
uncheck all the startup items
uncheck all the services
Restart
Run your anti virus software. The torjan will get defeated.
(You cant delete the torjan since it is running.)
run msconfig again and check the startup and service items which you require.

 
0
 

This is very effective:
Run msconfig;
uncheck all the startup items
uncheck all the services
Restart
Run your anti virus software. The torjan will get defeated.
(You cant delete the torjan since it is running.)
run msconfig again and check the startup and service items which you require.

Ive never tried that ,if you do uncheck all those things how do you get to you desktop if you disable all startups and processes !

 
0
 

I wouldn't advise it myself. Though I have never actually tried it, or heard of it being tried.
If you can locate those files geezer, then delete them.
Me off to bed now. Back up and at it in another 7 hours :(.

 
0
 

I'm on my lunch at the minute so I can't really do much... Any way the jury seems to be out on how to get rid of this beastie...

I can't be the only one to get it can I? Can I? Please tell me I'm not the only one
:cry:

Every time I think I'm doing some thing smart, I out-stupid myself...

I'll delete all the files in the eScan log. I hope I haven't banjaxed everything by doing a system restore when some of the system restore files are infected...

G'night Crunchie. Sweet dreams... Do you guys see HJT logs when you're drifting off to sleep? :D

Go raibh maith agat agus slan!

You
This article has been dead for over six months: Start a new discussion instead
Post:
Start New Discussion
Tags Related to this Article