Rootkit Trojan

July 17, 2009 at 18:36:41
Specs: Windows XP
I've got the same rootkit virus on both laptop and my dell PC (running Windows XP). Based on another post I've already downloaded and run AVZ. The log for the laptop is here:

http://rapidshare.com/files/2570356...

Please help. I'm going nuts. I'm not touching my PC quite yet.


See More: Rootkit Trojan

Report •


#1
July 17, 2009 at 18:40:57
That is wrong file. First Run this before we move to manual removal:

Download and run Kaspersky AVP tool in safe mode: http://devbuilds.kaspersky-labs.com...
Once you download and start the tool in safe mode:

# Check below options:

    * Select all the objects/places to be scanned. 
    * Settings > Customize > Heuristic analyzer > Enable deep rootkit search

# Click Scan
# Fix what it detects
# Zip/Rar Scan log/Summary and upload it to rapidshare.com. Post download link in your next message.

Illustrated tutorial: http://img32.imageshack.us/img32/76...

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#2
July 17, 2009 at 18:47:49
downloading now. Thank you! I'll be posting soon!

Report •

#3
July 17, 2009 at 19:05:26
No safe mode! I get a blue screen. Aaaaack!

Report •

Related Solutions

#4
July 17, 2009 at 19:31:46
Run it in normal mode then. Also follow:

Follow these steps in order numbered:

1) Download GMER: http://gmer.net/download.php
[This version will download a randomly named file (Recommended).]

2) Disconnect from the Internet and close all running programs.

3) Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.

4) Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.

5) GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)

6) If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.

7) Now click the Scan button. If you see a rootkit warning window, click OK.

8) When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log and upload it rapidshare.com. Post the download link to the uploaded file in your post.

9) Exit GMER and re-enable all active protection when done.

Note: Please give me the exact name of the file you downloaded in step 1 + post your log from step 8 in your next post.


If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#5
July 18, 2009 at 07:42:59
Sounds similar to the problem I just had.

http://www.computing.net/answers/se...

Try booting off the WinXP disc & press "R" to start the recovery console. Type FIXMBR & press ENTER...you may get a warning about having a non-standard MBR. Ignore the warning, type "Y" & press ENTER. When it's complete, type EXIT & press ENTER. Boot back into Windows & rerun your scans.


Report •

#6
July 18, 2009 at 20:26:03
ok, I'm going to try and get you this log.
we've been working all day on this (and last night), lol. Whew. The Kaspersky finally got all the way through. I don't know what to do with the DOS batch file under "logs" but I also downloaded a text file report. I hope I'm doing it right.

http://rapidshare.com/files/2574191...

http://rapidshare.com/files/2574191...

http://rapidshare.com/files/2574191...

I hope one of these is what you're asking for. I'm a bit dense when it comes to logs.


Report •

#7
July 18, 2009 at 20:29:32
Which computer was this laptop or dell? Is the problem solved?

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#8
July 18, 2009 at 21:31:49
GMER log

http://rapidshare.com/files/2574364...

gmer version d/l:

me5i78ru


Report •

#9
July 18, 2009 at 21:42:14
Apologies, I should have been specific. It's the laptop.

Report •

#10
July 18, 2009 at 21:45:55
Unfortunately,the problem is not yet solved. I hope I followed all the steps correctly.

Report •

#11
July 19, 2009 at 05:29:21
Note: I can help you remove malware manually. Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible. First Track this topic. Then follow:

1) Can you please post your AVZ log:
Note: Run AVZ in windows normal mode and make sure you are connect to internet. If avz.exe doesn't start, then try to rename the file avz.exe to something else and try to run it again. Make sure you have your web browser open in background before following the steps below.

i) To create the log file, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

ii) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

iii) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator.

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteAVUpdateEx( 'http://avz.virusinfo.info/avz_up/', 1, '','','');
ExecuteStdScr(3);
RebootWindows(true);
end.


Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

2) Download and Run DDS which will create a Pseudo HJT Report as part of its log: DDS Tool Download Link. When done, DDS will open two (2) logs

   1. DDS.txt
   2. Attach.txt

Upload the logs to rapidshare.com and paste download link in your next reply.
Note: Disable any script-blocking programs and then double-click on the DDS.scr icon to start the program. If you did not disable a script-blocker that may be part of your antimalware program, you may receive a warning from your antimalware product asking if you would like DDS.scr to run. Please allow it to do so.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#12
July 19, 2009 at 09:53:16
Thank you. I'm ok in the downloading department now. My husband, unbeknownst to me, downloaded a Webroot Shield. It's blocking trojans trying to stop programs. That's how I'm able to run these programs, including malware bytes at this point.

My PC was a horror yesterday. We finally found the recovery disk and created all sorts of mayhem. By the grace of he-who-watches-over-idiots, somehow we stopped the dreaded "blue screen" from popping up yet again, many hours later. For awhile there, I was sure I was going to have to scrap it. Oh the tears!

To make a long story longer, while I'm doing the next steps as per your kind and patient instructions, I'll be trying to download the shield on the PC so I can connect to the internet and begin to get it fixable and begin the log process. It was in far worse shape than the laptop.

Thank you so much for your continuing help. I've been a mess and you've been wonderfully patient.

Beginning the next round of instructions!


Report •

#13
July 19, 2009 at 09:59:09
Fix one thing at a time Lets fix laptop first. Follow: Response Number 11 Please read/follow carefully all the instruction. If you can't download via internet. Then download it on another computer and transfer it via USB or boot into safe mode with networking and download it. Leave other computer for now.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#14
Report •

#15
July 19, 2009 at 14:46:33
Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step:

1) Run this script in AVZ like before, your computer will reboot:

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 StopService('ijfyyjm');
 DeleteService('ijfyyjm');
 StopService('gktdbiysucum');
 DeleteService('gktdbiysucum');
 StopService('expIorer');
 DeleteService('expIorer');
 StopService('cqprh');
 DeleteService('cqprh');
 StopService('acsb');
 DeleteService('acsb');
 RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{95D88B35-A521-472B-A182-BB1A98356421}');
 QuarantineFile('C:\WINDOWS\DOWNLO~1\MATHPL~1.OCX','');
 QuarantineFile('C:\WINDOWS\DOWNLO~1\PEARSO~1.OCX','');
 QuarantineFile('khfEVPhf.dll','');
 QuarantineFile('C:\WINDOWS\TEMP\smss.exe','');
 QuarantineFile('C:\WINDOWS\system32\CTMBHA.DLL','');
 QuarantineFile('C:\Documents and Settings\Jessica Tighe\reader_s.exe','');
 QuarantineFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\pwmnw9b41.exe','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\mchInjDrv.sys','');
 QuarantineFile('dnufhek.sys','');
 QuarantineFile('C:\WINDOWS\System32\drivers\67866b60.sys','');
 QuarantineFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\IJFYYJM.exe','');
 QuarantineFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\GKTDBIYSUCUM.exe','');
 QuarantineFile('C:\WINDOWS\system32\expIorer.exe','');
 QuarantineFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\CQPRH.exe','');
 QuarantineFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\ACSB.exe','');
 DeleteFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\ACSB.exe');
 DeleteFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\CQPRH.exe');
 DeleteFile('C:\WINDOWS\system32\expIorer.exe');
 DeleteFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\GKTDBIYSUCUM.exe');
 DeleteFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\IJFYYJM.exe');
 DeleteFile('C:\WINDOWS\System32\drivers\67866b60.sys');
 DeleteFile('dnufhek.sys');
 DeleteFile('C:\WINDOWS\system32\Drivers\mchInjDrv.sys');
 DeleteFile('C:\DOCUME~1\JESSIC~1\LOCALS~1\Temp\pwmnw9b41.exe');
 DeleteFile('C:\Documents and Settings\Jessica Tighe\reader_s.exe');
 DeleteFile('C:\WINDOWS\TEMP\smss.exe');
 DeleteFile('khfEVPhf.dll');
 DeleteFile('C:\WINDOWS\DOWNLO~1\PEARSO~1.OCX');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

2) After reboot execute following script in AVZ:

begin
CreateQurantineArchive('C:\quarantine1.zip');    
end.


A file called quarantine1.zip should be created in C:\. Upload that file to rapidshare.com and Private message me download link.

3) Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please upload that file to rapidshare.com and paste the link here.

4) Please zip up C:\qoobox\quarantine and upload it, to a filehost such as http://rapidshare.com/ Then, Private Message me the Download links to the uploaded files.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#16
July 19, 2009 at 14:49:10
Malware Bytes picked up rootkit.bagel?

Report •

#17
July 19, 2009 at 14:51:38
Please read first NOTE: in Response Number 11 carefully again.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#18
July 19, 2009 at 15:09:05
Apologies, all sorts of things running on here. I hope I disabled everything.

http://rapidshare.com/files/2577269...

http://rapidshare.com/files/2577269...


Report •

#19
July 19, 2009 at 15:40:23
Which Step are you on?

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#20
Report •

#21
July 19, 2009 at 16:01:22
Step - quarantine1

moving to the combofix.


Report •

#22
July 19, 2009 at 16:46:11
http://rapidshare.com/files/2577511...

combofix.txt


Report •

#23
July 19, 2009 at 16:49:12
Am I fixed? The red x in my system tray is gone?

Report •

#24
July 19, 2009 at 16:51:57
Please follow the last step and private message me the link. After you do that redo Response Number 11 and post new set of logs.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#25
July 19, 2009 at 18:13:46
Redoing response #11 A)

http://rapidshare.com/files/2577695...

B) To be continued...


Report •

#26
Report •

#27
July 19, 2009 at 18:32:19
Redo Response Number 4 aswell.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#28
July 19, 2009 at 18:43:34
http://rapidshare.com/files/2577768...

:)


Report •

#29
July 19, 2009 at 19:04:54
Rootkit is still there. Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step:

1) Run this script in AVZ like before, your computer will reboot:

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 StopService('sshrmd');
 DeleteService('sshrmd');
 QuarantineFile('c:\documents and settings\All Users\Application Data\10438904\*','');
 QuarantineFile('c:\windows\system32\diskcheck.exe','');
 DeleteFile('c:\windows\system32\diskcheck.exe');
 QuarantineFile('c:\windows\system32\geyekrsxmupoow.dll','');
 DeleteFile('c:\windows\system32\geyekrsxmupoow.dll');
 QuarantineFile('c:\windows\system32\geyekrrpxnkmyn.dat','');
 DeleteFile('c:\windows\system32\geyekrrpxnkmyn.dat');
 QuarantineFile('c:\windows\system32\geyekrrqjixbir.dll','');
 DeleteFile('c:\windows\system32\geyekrrqjixbir.dll');
 QuarantineFile('c:\windows\system32\drivers\geyekrvkmtlouf.sys','');
 DeleteFile('c:\windows\system32\drivers\geyekrvkmtlouf.sys');
 QuarantineFile('C:\WINDOWS\System32\drivers\67866b60.sys','');
 DeleteFile('C:\WINDOWS\System32\drivers\67866b60.sys');
BC_Importall;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

2) After reboot execute following script in AVZ:

begin
CreateQurantineArchive('C:\quarantine2.zip');    
end.


A file called quarantine2.zip should be created in C:\. Upload that file to rapidshare.com and Private message me download link.

3) Redo Response Number 11 Step 2 (DDS)

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#30
July 19, 2009 at 19:08:58
I'm on it.

Report •

#31
July 19, 2009 at 19:57:38
Seems like laptop is almost finished, How is your laptop running? Follow:

1) Please run a BitDefender Online Scan

    * Click I Agree to agree to the EULA.
    * Allow the ActiveX control to install when prompted.
    * Click Cleaning Options > Scanning options > Scan files > Select "Scan all files" > Press "OK"
    * Click Start Scan to begin the scan.
    * Please refrain from using the computer until the scan is finished. This might take a while to run, but it is important that nothing else is running while you scan.
    * When the scan is finished, click on Click here to export the scan results.
    * Save the report to your desktop so you can post it in your next reply.

2) Install, update database and run full scan with Malwarebytes' Anti-Malware. Attach malwarebyte full scan log, fix anything detected.

3) Download ccleaner - http://www.ccleaner.com/download/bu... run temp and registry cleaner with it.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#32
July 19, 2009 at 20:08:47
It's running so much better. I'm so grateful for your patience and expertise.

I'll be finishing the laptop up here per your instructions. I'm so impressed with the nifty programs you had me use. Amazing.

The tough one looms ahead. The PC. Ugh, blue screen pops up shortly after windows loads. We're working on that shield.


Report •

#33
July 19, 2009 at 20:17:14
Can you boot into safe mode with other PC? Which shield? on desktop? On the laptop follow before following above steps:

Uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#34
July 19, 2009 at 21:39:39
I think the PC is dead. It won't even boot to windows now. :(

Report •

#35
July 19, 2009 at 21:51:37
What is stop error code?

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#36
July 19, 2009 at 22:07:41
stop error code?

I'm not sure what that is? I'm sorry for my ignorance. The PC is in really bad shape.


Report •

#37
July 20, 2009 at 05:58:40
If you can't even login via normal or safe mode only option left is format and reinstall.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#38
July 26, 2009 at 09:50:38
OK, my computer is with my husband's co-worker who is able to get in to windows by tricking the malware. Hopefully he can figure out what I can't. :) So I guess we'll get to the computer when I get it back.

Malware bytes isn't picking anything up. But spysweeper is. 21 minutes into the sweep picks this up:

Adware found: virtumonde
Spy Cookie found: pointroll cookie
Spy Cookie found: atlas dmt cookie
Spy Cookie found: questionmarket cookie
Virus found: Mal/Generic-A
Virus found: Mal/RKRustok-B
Virus found: Mal/Behav-210

Detected
Items 7
Traces 12

Malware Bytes usually picks up anything running around. So is it picking these up in the quarantine file?


Report •

#39
July 26, 2009 at 10:04:23
Post a complete log. Which PC is this?

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#40
July 28, 2009 at 17:39:52
I'm still on the laptop. It took morning until now but I ran a full kaspersky scan and the log is here:

http://rapidshare.com/files/2611933...


Report •

#41
July 29, 2009 at 10:30:36
Having problems with my internet. If double post, my apologies.

AVZ log here:

http://rapidshare.com/files/2614553...


Report •

#42
July 29, 2009 at 10:42:26
No need for AVZ your laptop is clean are you still experiencing problems? C:\Documents and Settings\Jessica Tighe\Desktop\C.rar << what in that folder? Did you uninstall combofix (Response Number 33)?

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#43
July 29, 2009 at 11:23:30
Yep, I'm pretty sure I uninstalled combo-fix. I'm not sure what's in C.rar. Should I open it? LOL, I'm afraid, very afraid.

Bitdefender picked up the same things spysweeper did.


Report •

#44
July 29, 2009 at 12:44:36
Post bitdefender scan log from Response Number 31.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#45
July 29, 2009 at 13:20:17
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Real Time Virus Report</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="20" marginwidth="0" topmargin="20" marginheight="0" >


<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td>

<span style="font-size:11pt;">BitDefender
Online Scanner - Real Time Virus Report
</span>
</p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td colspan="3">

<span style="font-size:11pt;">Generated
at: Tue, Jul 28, 2009 - 00:50:55</span>
</p>
</td>
</tr>
<tr>
<td>
<hr size="1" width="100%" align="left" noshade color="black">

 </p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

<span style="font-size:11pt;">Scan
Info
</span>
</p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="75%">

<span style="font-size:11pt;">Scanned
Files</span>
</p>
</td>
<td width="25%">

<span style="font-size:11pt;">501069</span></p>
</td>
</tr>
<tr>
<td width="75%">

<span style="font-size:11pt;">Infected Files</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">9</span></p>
</td>
</tr>
</table>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

<span style="font-size:11pt;"> </span></p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

<span style="font-size:11pt;">Virus
Detected
</span>
</p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="75%">

<span style="font-size:11pt;">Rootkit.24098</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">1</span></p>
</td>
</tr><tr>
<td width="75%">

<span style="font-size:11pt;">Gen:Trojan.Heur.Zbot.aq5@beGr@sn</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">1</span></p>
</td>
</tr><tr>
<td width="75%">

<span style="font-size:11pt;">Trojan.Downloader.Small.ABIN</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">1</span></p>
</td>
</tr><tr>
<td width="75%">

<span style="font-size:11pt;">Backdoor.Rustock.NFT</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">2</span></p>
</td>
</tr><tr>
<td width="75%">

<span style="font-size:11pt;">Trojan.Generic.2168153</span></p>
</td>
<td width="25%">

<span style="font-size:11pt;">4</span></p>
</td>
</tr>
</table>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

 </p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

 </p>
<hr size="1" width="100%" align="left" noshade color="black">
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
<tr>
<td>

<span style="font-size:8pt;">This
summary of the scan process will be used by the BitDefender Antivirus
Lab to create agregate statistics about virus activity around the
world. </span>
</p>
</td>
<td width="10%">

 </p>
</td>
<td width="10%">

 </p>
</td>
</tr>
</table>

 </p>

</body>
</html>


Report •

#46
July 29, 2009 at 13:44:40
Edit your post above and upload that file to rapidshare.com and post a download link.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#47
July 31, 2009 at 09:42:12
I can't seem to edit my above post.

The file is here:

http://rapidshare.com/files/2621976...


Report •

#48
July 31, 2009 at 10:15:03
Run the scan again to see if its clean.

If I'm helping you and I don't reply within 24 hours send me a PM.


Report •

#49
July 31, 2009 at 13:12:42
It's clean! It didn't pick up anything! So it's all done?

Thank you so much for your patient help. You've helped me save more than you know.

The boys are doing something to the PC. DH went and got another C Drive? today. When they're done with whatever they're doing I'll post a new thread for the PC to properly do whatever it is I need to do to wipe it.

Again, thank you. I know your time is valuable and I sincerely appreciate the time you've given to me. :)


Report •


Ask Question