Problem med Backdoor.Tidserv!inf

Mit Symantec Antivirus har problemer med Backdoor.Tidserv!inf - den siger at atapi.sys er inficeret.

Jeg har fulgt opfordringerne i tråden http://www.eksperten.dk/spm/855725 og har kørt SDFix:


SDFix: Version 1.240
Run by Administrator on 27-12-2009 at 10:41

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



                                Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-27 11:22:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"F:\\Programmer\\Linksys\\KiSS PC-Link\\KiSS_PC-Link.exe"="F:\\Programmer\\Linksys\\KiSS PC-Link\\KiSS_PC-Link.exe:*:Enabled:KiSS_PC-Link"
"F:\\Programmer\\FileZilla\\FileZilla.exe"="F:\\Programmer\\FileZilla\\FileZilla.exe:*:Enabled:FileZilla"
"C:\\Programmer\\Pinnacle\\Studio 10\\programs\\Studio.exe"="C:\\Programmer\\Pinnacle\\Studio 10\\programs\\Studio.exe:*:Enabled:Studio program file"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:Windows Stifinder"
"F:\\Programmer\\Mozilla Firefox\\firefox.exe"="F:\\Programmer\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"F:\\Programmer\\VideoLAN\\VLC\\vlc.exe"="F:\\Programmer\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Programmer\\Pinnacle\\Studio 11\\programs\\RM.exe"="C:\\Programmer\\Pinnacle\\Studio 11\\programs\\RM.exe:*:Enabled:Render Manager"
"C:\\Programmer\\Pinnacle\\Studio 11\\programs\\Studio.exe"="C:\\Programmer\\Pinnacle\\Studio 11\\programs\\Studio.exe:*:Enabled:Studio"
"C:\\Programmer\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"="C:\\Programmer\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile"
"C:\\Programmer\\Pinnacle\\Studio 11\\programs\\umi.exe"="C:\\Programmer\\Pinnacle\\Studio 11\\programs\\umi.exe:*:Enabled:umi"
"C:\\Programmer\\uTorrent\\uTorrent.exe"="C:\\Programmer\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Programmer\\Synology Assistant\\DSAssistant.exe"="C:\\Programmer\\Synology Assistant\\DSAssistant.exe:*:Enabled:DSAssistant"
"D:\\Windows\\DSAssistant\\Application\\DSAssistant.exe"="D:\\Windows\\DSAssistant\\Application\\DSAssistant.exe:*:Enabled:Synology Assistant"
"C:\\Programmer\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Programmer\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Programmer\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Programmer\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\\Programmer\\TeamViewer3\\TeamViewer.exe"="C:\\Programmer\\TeamViewer3\\TeamViewer.exe:*:Enabled:TeamViewer fjernstyringsprogram"
"C:\\Documents and Settings\\Carsten\\temp\\TeamViewer\\Version4\\TeamViewer.exe"="C:\\Documents and Settings\\Carsten\\temp\\TeamViewer\\Version4\\TeamViewer.exe:*:Enabled:TeamViewer fjernstyringsprogram"
"C:\\Programmer\\Bonjour\\mDNSResponder.exe"="C:\\Programmer\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Programmer\\Skype\\Phone\\Skype.exe"="C:\\Programmer\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"F:\\Programmer\\AirPort\\APAgent.exe"="F:\\Programmer\\AirPort\\APAgent.exe:*:Enabled:AirPort"
"C:\\Programmer\\Messenger\\msmsgs.exe"="C:\\Programmer\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Programmer\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Programmer\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Programmer\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Programmer\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"

Remaining Files :



Files with Hidden Attributes :

Wed  3 May 2006      163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007        31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Sun 16 Mar 2008      216,064 ..SHR --- "C:\WINDOWS\system32\nbDX.dll"
Sat 21 Mar 2009        4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue  7 Feb 2006      299,008 A..H. --- "C:\Programmer\Canon\CanoScan Toolbox Ver5.0\Maint.exe"
Mon 28 Feb 2005        61,440 A..H. --- "C:\Programmer\Canon\CanoScan Toolbox Ver5.0\uinstrsc.dll"
Sun 26 Jun 2005      616,448 ..SHR --- "C:\Programmer\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005        45,568 ..SHR --- "C:\Programmer\eRightSoft\SUPER\cygz.dll"
Sat 15 Aug 2009        90,624 ..SHR --- "C:\Programmer\eRightSoft\SUPER\Setup.exe"
Sun 19 Oct 2008        15,935 A.SHR --- "C:\Programmer\eRightSoft\SUPER\_Setup.dll"
Wed 23 Sep 2009      714,528 ...H. --- "C:\Documents and Settings\Anni\Lokale indstillinger\Temp\BIT5.tmp"
Tue  4 Jun 2002        84,992 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue  4 Jun 2002        44,032 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002        73,766 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002        65,575 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun  9 Jun 2002        36,864 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue  4 Jun 2002        20,480 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002      102,437 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002      176,165 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002      208,935 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002      217,127 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun  9 Jun 2002        40,448 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sat  3 Nov 2001      225,280 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001      225,280 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004      232,960 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\raac.dll"
Sun  9 Jun 2002      525,824 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002      245,805 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002        45,093 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002        98,341 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002        94,247 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002        90,151 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002      102,439 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun  9 Jun 2002        49,152 ...HR --- "C:\Programmer\eRightSoft\SUPER\mencoder\tokr3260.dll"
Thu 20 Mar 2008        5,632 ..SHR --- "C:\Programmer\eRightSoft\SUPER\spk\1stRun.exe"
Mon 21 Dec 2009    3,062,784 ...H. --- "C:\Documents and Settings\Carsten\Application Data\Microsoft\Word\~WRL0846.tmp"
Mon 21 Dec 2009    3,650,048 ...H. --- "C:\Documents and Settings\Carsten\Application Data\Microsoft\Word\~WRL1813.tmp"
Mon 21 Dec 2009        27,648 ...H. --- "C:\Documents and Settings\Carsten\Application Data\Microsoft\Word\~WRL1829.tmp"
Mon 21 Dec 2009        27,648 ...H. --- "C:\Documents and Settings\Carsten\Application Data\Microsoft\Word\~WRL1998.tmp"
Tue 23 Dec 2008        29,184 ...H. --- "C:\Documents and Settings\Carsten\Application Data\Microsoft\Word\~WRL2188.tmp"

Finished!



Jeg har også kørt HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:56:37, on 27-12-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Programmer\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Programmer\Java\jre6\bin\jqs.exe
F:\Programmer\LogMeIn\x86\RaMaint.exe
F:\Programmer\LogMeIn\x86\LogMeIn.exe
F:\Programmer\LogMeIn\x86\LMIGuardian.exe
C:\Programmer\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Programmer\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Programmer\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Programmer\Mozilla Firefox\firefox.exe
F:\Programmer\printKey\Printkey.exe
C:\Programmer\Symantec Client Security\Symantec AntiVirus\DoScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Java\jre6\bin\jucheck.exe
F:\Backed Up\Persistent\My Download Files\FireFoxDownloads\HiJackThis(2).exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe ylse.wyo jjahqmx
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Fælles filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmer\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmer\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Printkey.lnk = F:\Programmer\printKey\Printkey.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Programmer\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1199221266462
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://print2peoplephoto.com/photo/library/ImageUploader3.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{AF1D02F2-2DD9-4C95-BE32-E75C4802CD95}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programmer\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Programmer\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmer\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - F:\Programmer\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - F:\Programmer\LogMeIn\x86\LogMeIn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programmer\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programmer\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Programmer\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

--
End of file - 8375 bytes


Håber på lidt Julehjælp :-)