www.MegaLab.it

da **klinik** » mer lug 21, 2004 3:44 pm

Salve, stò letteralmente sclerando per un dannato programma.
Come pagina iniziale mi mette: http://weba.directwebsearch.net/index.html

Ho installato i seguenti programmi che mi hanno tolto di tutto meno che sta stramaledetta pagina.

AW-aware 6
HijackThis
Pest Patrol
Spy Bot Killer
SpHjfix
CWShredder (che mi cancella tutte le chiavi di registro ma poi al riavvio ci sono ancora)

ho win xp e stranamente se faccio ctrl alt canc il task manager mi mostra solo le applicazioni,
per cui non riesco a vedere i file in esecuzione in background.

Cosa mi suggerite di fare???

Grazie
Gabriele

da **crazy.cat** » mer lug 21, 2004 4:19 pm

Ti aspetto, leggi qui intanto
http://www.zanezane.net/articoli.asp?id=453

da **klinik** » mer lug 21, 2004 4:39 pm

Vi ringrazio, questo il file di log.

Logfile of HijackThis v1.98.0
Scan saved at 17.38.12, on 21/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:ProgrammiAVPersonalAVGUARD.EXE
C:ProgrammiAVPersonalAVWUPSRV.EXE
C:ProgrammiFile comuniEPSONEBAPISAgent2.exe
C:ProgrammiAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSsystem32oneLabsvsmon.exe
C:WINDOWSSystem32carpserv.exe
C:PROGRA~1ONELA~1ONEAL~1zlclient.exe
C:ProgrammiAnalog DevicesSoundMAXSMTray.exe
C:ProgrammiAVPersonalAVGNT.EXE
C:WINDOWSSystem32ctfmon.exe
C:ProgrammiARESCOMModem Telindus Arescom ND220dslmon.exe
C:Documents and SettingsAdminDesktopTogli SpiwareHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Explorer,Search = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,Search = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,SearchURL = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://weba.directwebsearch.net/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://weba.directwebsearch.net/index.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://weba.directwebsearch.net/index.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer By Web Promotions Cavalese
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O1 - Hosts: 127.0.0.0 localhost
O1 - Hosts: 127.0.0.2 auditmypc.com
O1 - Hosts: 127.0.0.3 boards.cexx.org
O1 - Hosts: 127.0.0.4 bulletproofsoft.net
O1 - Hosts: 127.0.0.5 camtech2000.net
O1 - Hosts: 127.0.0.6 cexx.org
O1 - Hosts: 127.0.0.7 computercops.us
O1 - Hosts: 127.0.0.8 ct7support.com
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.20 kellys-korner-xp.com
O1 - Hosts: 127.0.0.21 kephyr.com
O1 - Hosts: 127.0.0.22 lavasoft.de
O1 - Hosts: 127.0.0.23 lavasoftusa.com
O1 - Hosts: 127.0.0.24 lurkhere.com
O1 - Hosts: 127.0.0.25 majorgeeks.com
O1 - Hosts: 127.0.0.26 merijn.org
O1 - Hosts: 127.0.0.27 mjc1.com
O1 - Hosts: 127.0.0.28 moosoft.com
O1 - Hosts: 127.0.0.29 mvps.org
O1 - Hosts: 127.0.0.30 net-integration.net
O1 - Hosts: 127.0.0.31 noadware.net
O1 - Hosts: 127.0.0.32 no-spybot.com
O1 - Hosts: 127.0.0.33 onlinepcfix.com
O1 - Hosts: 127.0.0.34 pchell.com
O1 - Hosts: 127.0.0.35 pestpatrol.com
O1 - Hosts: 127.0.0.36 safer-networking.org
O1 - Hosts: 127.0.0.37 secure.spykiller.com
O1 - Hosts: 127.0.0.38 secureie.com
O1 - Hosts: 127.0.0.39 security.kolla.de
O1 - Hosts: 127.0.0.40 spybot.info
O1 - Hosts: 127.0.0.41 spychecker.com
O1 - Hosts: 127.0.0.42 spychecker.com
O1 - Hosts: 127.0.0.43 spycop.com
O1 - Hosts: 127.0.0.44 spyguard.com
O1 - Hosts: 127.0.0.45 spykiller.com
O1 - Hosts: 127.0.0.46 spyware.co.uk
O1 - Hosts: 127.0.0.47 spyware-cop.com
O1 - Hosts: 127.0.0.49 spywarenuker.com
O1 - Hosts: 127.0.0.50 spywareremove.com
O1 - Hosts: 127.0.0.51 spywareremove.com
O1 - Hosts: 127.0.0.52 stopzillapro.com
O1 - Hosts: 127.0.0.53 sunbelt-software.com
O1 - Hosts: 127.0.0.54 thiefware.com
O1 - Hosts: 127.0.0.55 tomcoyote.org
O1 - Hosts: 127.0.0.56 unwantedlinks.com
O1 - Hosts: 127.0.0.57 webattack.com
O1 - Hosts: 127.0.0.58 wilders.org
O1 - Hosts: 127.0.0.59 www.auditmypc.com
O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net
O1 - Hosts: 127.0.0.61 www.cexx.org
O1 - Hosts: 127.0.0.62 www.computercops.us
O1 - Hosts: 127.0.0.63 www.ct7support.com
O1 - Hosts: 127.0.0.64 www.doxdesk.com
O1 - Hosts: 127.0.0.65 www.eblocs.com
O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com
O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com
O1 - Hosts: 127.0.0.68 www.free-web-browsers.com
O1 - Hosts: 127.0.0.69 www.grc.com
O1 - Hosts: 127.0.0.70 www.grisoft.com
O1 - Hosts: 127.0.0.71 www.hackfaq.org
O1 - Hosts: 127.0.0.72 www.hazeleger.net
O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com
O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com
O1 - Hosts: 127.0.0.75 www.kephyr.com
O1 - Hosts: 127.0.0.76 www.lavasoft.de
O1 - Hosts: 127.0.0.77 www.lavasoftusa.com
O1 - Hosts: 127.0.0.78 www.lurkhere.com
O1 - Hosts: 127.0.0.79 www.majorgeeks.com
O1 - Hosts: 127.0.0.80 www.merijn.org
O1 - Hosts: 127.0.0.81 www.mjc1.com
O1 - Hosts: 127.0.0.82 www.moosoft.com
O1 - Hosts: 127.0.0.83 www.mvps.org
O1 - Hosts: 127.0.0.84 www.net-integration.net
O1 - Hosts: 127.0.0.85 www.noadware.net
O1 - Hosts: 127.0.0.86 www.no-spybot.com
O1 - Hosts: 127.0.0.87 www.onlinepcfix.com
O1 - Hosts: 127.0.0.88 www.pchell.com
O1 - Hosts: 127.0.0.89 www.pestpatrol.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:ProgrammiAdobeAcrobat 6.0ReaderActiveXAcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O4 - HKLM..Run: [CARPService] carpserv.exe
O4 - HKLM..Run: [Zone Labs Client] C:PROGRA~1ONELA~1ONEAL~1zlclient.exe
O4 - HKLM..Run: [smapp] C:ProgrammiAnalog DevicesSoundMAXSMTray.exe
O4 - HKLM..Run: [winupd] C:WINDOWSSystem32winupd.exe
O4 - HKLM..Run: [AVGCtrl] "C:ProgrammiAVPersonalAVGNT.EXE" /min
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - Global Startup: DSLMON.lnk = ?
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 - Extra context menu item: &iSearch The Web - res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:WINDOWSSystem32msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammiMessengerMSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammiMessengerMSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.valfiemme.com
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.accessoveloce.com/cit/x/citring1x.exe
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} -
O16 - DPF: {11111111-1111-1111-1111-111111113456} - file://c:info6.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:Program FilesQ330994.exe
O17 - HKLMSystemCCSServicesTcpip..{F7D19610-7AA4-4539-9AD4-9B602034FC18}: NameServer = 192.168.0.1

Gabriele [?]

da **crazy.cat** » mer lug 21, 2004 5:20 pm

Ha un gran macello,più che altro,figuriamoci quello che aveva già tolto. Se usi Spybot c'è una funzione di immunizza che blocca l'arrivo di tante schifezze, la stessa cosa c'è anche in spywareblaster.

Creati una cartella a parte e copiaci dentro hijackthis,rifai la scansione e metti il flag alle voci che ti indico sotto e poi premi fix.

R1 - HKCUSoftwareMicrosoftInternet Explorer,Search = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,Search = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet Explorer,SearchURL = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://weba.directwebsearch.net/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://weba.directwebsearch.net/index.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://weba.directwebsearch.net/search.html
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://weba.directwebsearch.net/index.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://weba.directwebsearch.net/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://weba.directwebsearch.net/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://weba.directwebsearch.net/search.html
O3 - Toolbar: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file)
O8 - Extra context menu item: &iSearch The Web - res://C:WINDOWSSystem32 oolbar.dll/SEARCH.HTML
O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.accessoveloce.com/cit/x/citring1x.exe
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://c:MAIN.MHT!http://213.159.117.236/buka.chm::/x.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} -
O16 - DPF: {11111111-1111-1111-1111-111111113456} - file://c:info6.cab
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:Program FilesQ330994.exe

Questi a meno che non li hai inseriti tu, ti direi di eliminarli, la maggior parte sono indirizzi buoni, non capisco però perché siano così tanti, di solito non ci sono.
O1 - Hosts: 127.0.0.0 localhost
O1 - Hosts: 127.0.0.2 auditmypc.com
O1 - Hosts: 127.0.0.3 boards.cexx.org
O1 - Hosts: 127.0.0.4 bulletproofsoft.net
O1 - Hosts: 127.0.0.5 camtech2000.net
O1 - Hosts: 127.0.0.6 cexx.org
O1 - Hosts: 127.0.0.7 computercops.us
O1 - Hosts: 127.0.0.8 ct7support.com
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.20 kellys-korner-xp.com
O1 - Hosts: 127.0.0.21 kephyr.com
O1 - Hosts: 127.0.0.22 lavasoft.de
O1 - Hosts: 127.0.0.23 lavasoftusa.com
O1 - Hosts: 127.0.0.24 lurkhere.com
O1 - Hosts: 127.0.0.25 majorgeeks.com
O1 - Hosts: 127.0.0.26 merijn.org
O1 - Hosts: 127.0.0.27 mjc1.com
O1 - Hosts: 127.0.0.28 moosoft.com
O1 - Hosts: 127.0.0.29 mvps.org
O1 - Hosts: 127.0.0.30 net-integration.net
O1 - Hosts: 127.0.0.31 noadware.net
O1 - Hosts: 127.0.0.32 no-spybot.com
O1 - Hosts: 127.0.0.33 onlinepcfix.com
O1 - Hosts: 127.0.0.34 pchell.com
O1 - Hosts: 127.0.0.35 pestpatrol.com
O1 - Hosts: 127.0.0.36 safer-networking.org
O1 - Hosts: 127.0.0.37 secure.spykiller.com
O1 - Hosts: 127.0.0.38 secureie.com
O1 - Hosts: 127.0.0.39 security.kolla.de
O1 - Hosts: 127.0.0.40 spybot.info
O1 - Hosts: 127.0.0.41 spychecker.com
O1 - Hosts: 127.0.0.42 spychecker.com
O1 - Hosts: 127.0.0.43 spycop.com
O1 - Hosts: 127.0.0.44 spyguard.com
O1 - Hosts: 127.0.0.45 spykiller.com
O1 - Hosts: 127.0.0.46 spyware.co.uk
O1 - Hosts: 127.0.0.47 spyware-cop.com
O1 - Hosts: 127.0.0.49 spywarenuker.com
O1 - Hosts: 127.0.0.50 spywareremove.com
O1 - Hosts: 127.0.0.51 spywareremove.com
O1 - Hosts: 127.0.0.52 stopzillapro.com
O1 - Hosts: 127.0.0.53 sunbelt-software.com
O1 - Hosts: 127.0.0.54 thiefware.com
O1 - Hosts: 127.0.0.55 tomcoyote.org
O1 - Hosts: 127.0.0.56 unwantedlinks.com
O1 - Hosts: 127.0.0.57 webattack.com
O1 - Hosts: 127.0.0.58 wilders.org
O1 - Hosts: 127.0.0.59 www.auditmypc.com
O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net
O1 - Hosts: 127.0.0.61 www.cexx.org
O1 - Hosts: 127.0.0.62 www.computercops.us
O1 - Hosts: 127.0.0.63 www.ct7support.com
O1 - Hosts: 127.0.0.64 www.doxdesk.com
O1 - Hosts: 127.0.0.65 www.eblocs.com
O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com
O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com
O1 - Hosts: 127.0.0.68 www.free-web-browsers.com
O1 - Hosts: 127.0.0.69 www.grc.com
O1 - Hosts: 127.0.0.70 www.grisoft.com
O1 - Hosts: 127.0.0.71 www.hackfaq.org
O1 - Hosts: 127.0.0.72 www.hazeleger.net
O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com
O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com
O1 - Hosts: 127.0.0.75 www.kephyr.com
O1 - Hosts: 127.0.0.76 www.lavasoft.de
O1 - Hosts: 127.0.0.77 www.lavasoftusa.com
O1 - Hosts: 127.0.0.78 www.lurkhere.com
O1 - Hosts: 127.0.0.79 www.majorgeeks.com
O1 - Hosts: 127.0.0.80 www.merijn.org
O1 - Hosts: 127.0.0.81 www.mjc1.com
O1 - Hosts: 127.0.0.82 www.moosoft.com
O1 - Hosts: 127.0.0.83 www.mvps.org
O1 - Hosts: 127.0.0.84 www.net-integration.net
O1 - Hosts: 127.0.0.85 www.noadware.net
O1 - Hosts: 127.0.0.86 www.no-spybot.com
O1 - Hosts: 127.0.0.87 www.onlinepcfix.com
O1 - Hosts: 127.0.0.88 www.pchell.com
O1 - Hosts: 127.0.0.89 www.pestpatrol.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk

Per questo c'è un dubbio prova a seguire tutte e due le istruzioni, sopratutto quelle nel secondo link
O4 - HKLM..Run: [winupd] C:WINDOWSSystem32winupd.exe
http://securityresponse.symantec.com/av ... chnew.html
C'è link ad un tools di rimozione,prova ad usarlo
http://securityresponse.symantec.com/av ... 2.beagle.n @ mm.html
Togli gli spazi frà la @ e incollati il link nella barra degli indirizzi,ho dovuto scriverlo così altrimenti andava in errore.

Cancella anche i cookies e i files temporanei di internet.
finito tutto riavvia il pc e prova 2/3 volte a ricollegarti, se rifacesse il problema prova a ripostare qui il log di hijackthis

da **klinik** » mer lug 21, 2004 6:11 pm

Ciao, premetto che:
Ho aggiornato l'antivirus e scansionato il tutto una volta.
poi prova un programma, prova un altro, ecc ho disintallato free av, e scaricato la versione nuova dal sito.
Reinstallato free av e riscansionato il tutto.
Non mi ha trovato niente.
Fatto norton antivirus versione dos con aggiornamento di oggi e non ha trovato niente.
Adesso mi sono scaricato il fix beagle FxBgleMO.exe e lo ho eseguito...
adesso, che il fix si è avviato e stà scansionando, free av ha trovato:

21/07/2004,18.13.15 AVGuard has been started successfully!
21/07/2004,18.40.16 WARNING: The Trojan horse TR/StartPage.AU.2!
C:PROGRAM FILESQ330994.EXE
File has been deleted!

No commment!

Il fix Beagle non ha trovato niente.
Poi ho lanciato HijackThis e selezionato tutte le voci cha mi hai detto.
Ho riavviato + volte e adesso è tutto ok!!!
Ho trovato ancora una chiave di registro con directwebsearch e l'ho cancellata.
Hi rieseguito HijackThis ed adesso ci sono solo 18 voci "normali".

Ti ringrazio una cifra, è da stamattina che provo!
A buon rendere.

Grazie
Gabriele

da **klinik** » mer lug 21, 2004 6:13 pm

Il pc non è mio, è di un mio amico.
Gabb [dance]

www.MegaLab.it

Maledetta pagina iniziale..

Maledetta pagina iniziale..

Chi c’è in linea