419 lines
18 KiB
Plaintext
419 lines
18 KiB
Plaintext
|
=============================================================================
|
|||
|
|
INTRANETWORK MEMORANDUM SPAN MANAGEMENT OFFICE
|
|||
|
|
=============================================================================
|
|||
|
|
19-OCT-1989
|
|||
|
|
|
|||
|
|
TO: ALL SPAN ROUTING CENTER MANAGERS AND REMOTE-NODE MANAGERS
|
|||
|
|
|
|||
|
|
FROM: RON TENCATI - SPAN SECURITY MANAGER
|
|||
|
|
GODDARD SPACE FLIGHT CENTER CODE 630.2
|
|||
|
|
GREENBELT, MD. 20771
|
|||
|
|
(301)286-5223
|
|||
|
|
|
|||
|
|
SUBJ: INFORMATION REGARDING THE DECNET WORM AND PROTECTION MEASURES
|
|||
|
|
|
|||
|
|
----------
|
|||
|
|
The following information covers several aspects of the "WANK" DECnet worm
|
|||
|
|
which was released into the "DECnet Internet" earlier in the week.
|
|||
|
|
|
|||
|
|
Information contained in prior reports written by John McMahon of GSFC and
|
|||
|
|
Kevin Oberman of LLNL was used in preparing report. The assistance of
|
|||
|
|
Digital Equipment Corporation is also gratefully acknowledged.
|
|||
|
|
|
|||
|
|
Previous messages regarding this worm appearing on various mailing lists
|
|||
|
|
have indicated that system managers with questions or infected nodes should
|
|||
|
|
call other organizations.
|
|||
|
|
|
|||
|
|
For clarification, any SPAN-connected system that believes itself to be
|
|||
|
|
infected, or attacked should contact ONLY the SPAN management at Goddard
|
|||
|
|
Space Flight Center, Greenbelt, MD. The security effort is being
|
|||
|
|
coordinated by this group and all reports should be directed there. The
|
|||
|
|
contact number is (301)286-7251 or (301)286-5223. Electronic mail should be
|
|||
|
|
sent to NSSDCA::TENCATI or NSSDCA::NETMGR only. Do not send infection
|
|||
|
|
reports to any other node on SPAN.
|
|||
|
|
|
|||
|
|
HEPnet sites should contact FNAL::DEMAR.
|
|||
|
|
|
|||
|
|
|
|||
|
|
BACKGROUND
|
|||
|
|
----------
|
|||
|
|
|
|||
|
|
The worm's mission is to propagate itself randomly across the network,
|
|||
|
|
to seek out systems with poor security, and to establish itself in a
|
|||
|
|
priviliged account whereupon it will modify the system's SYS$ANNOUNCE
|
|||
|
|
banner to the following message:
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
W O R M S A G A I N S T N U C L E A R K I L L E R S
|
|||
|
|
_______________________________________________________________
|
|||
|
|
\__ ____________ _____ ________ ____ ____ __ _____/
|
|||
|
|
\ \ \ /\ / / / /\ \ | \ \ | | | | / / /
|
|||
|
|
\ \ \ / \ / / / /__\ \ | |\ \ | | | |/ / /
|
|||
|
|
\ \ \/ /\ \/ / / ______ \ | | \ \| | | |\ \ /
|
|||
|
|
\_\ /__\ /____/ /______\ \____| |__\ | |____| |_\ \_/
|
|||
|
|
\___________________________________________________/
|
|||
|
|
\ /
|
|||
|
|
\ Your System Has Been Officically WANKed /
|
|||
|
|
\_____________________________________________/
|
|||
|
|
|
|||
|
|
You talk of times of peace for all, and then prepare for war.
|
|||
|
|
|
|||
|
|
---------
|
|||
|
|
We don't currently see that the WORM is destructive, BUT it wastes
|
|||
|
|
resources, and may result in denial of service by locking out priviliged
|
|||
|
|
users or causing non-infected nodes to consume disk space storing all the
|
|||
|
|
audit records from the failed access attempts.
|
|||
|
|
|
|||
|
|
The worm attempts to establish itself onto a system by exploiting various
|
|||
|
|
weaknesses in the DECnet environment. Some of these weaknesses have been
|
|||
|
|
addressed by previous SPAN directives and guidelines. Systems that have
|
|||
|
|
implemented these guidelines are not at risk.
|
|||
|
|
|
|||
|
|
A random number generator is used to pick the next node the worm will try
|
|||
|
|
to infect. The worm contains an internal list of 82 canned usernames that
|
|||
|
|
it will try against a system.
|
|||
|
|
|
|||
|
|
In addition, it attempts to copy the file RIGHTSLIST.DAT from the selected
|
|||
|
|
target node. This file is normally protected W:R. If this file is
|
|||
|
|
successfully copied, a list of usernames specific to the target system will
|
|||
|
|
be generated and some subset of those will be appended to the "canned"
|
|||
|
|
list. The candidate words the worm uses whether or not it was successful
|
|||
|
|
at accessing RIGHTSLIST.DAT are the following:
|
|||
|
|
|
|||
|
|
ACCOUNITING ACCOUNTS ALLIN1 APPLETALK ARCHIVE
|
|||
|
|
BACKUP CADCAM COGNOS CRAYSTN CUSTOMER
|
|||
|
|
DDSNET DEC DECNET DEFAULT DEMO
|
|||
|
|
DFS$DEFAULT DIGITAL DNS$SERVER DQS$SERVER ETHERNIM
|
|||
|
|
EXOS FIELD GAMES GUEST HASP
|
|||
|
|
IBM INGRES INVENTORY ISSYS IVP
|
|||
|
|
LIBRARY LN03_DLAND LPS$SERVER MAC MAIL
|
|||
|
|
MAILER MANAGER MANUALS MASS11 MBMANAGER
|
|||
|
|
MIS MRGATE MANAGER NETNONPRIV NETPRIV
|
|||
|
|
NEWSMGR NOTES$SERVER OPER OPERATOR ORACLE
|
|||
|
|
OSI PCAPP PCCOMMON PLUTO POSTMASTER
|
|||
|
|
RDBVMS$REM RHM SECURITY SHUTDOWN SNACSV
|
|||
|
|
SPEAR SPM SRS STUDENT SUPPLIES
|
|||
|
|
SYSINF SYSTEM SYSTEST SYSTEST_CLIG TAPESYS
|
|||
|
|
TCP TELEX TEMP TEST TRAINING
|
|||
|
|
TRANSFER USER USER1 USERP VAXNET
|
|||
|
|
VAXSIM VTX VXSYS
|
|||
|
|
|
|||
|
|
The PASSWORDS tried against the set of accounts MAY be the username
|
|||
|
|
ONLY, OR other passwords may be tried (such as DIGITAL, PSIPAD, MANAGER,
|
|||
|
|
etc) apparently depending on the version of the WORM. A bug in the worm
|
|||
|
|
prevents it from testing the null password as previously suspected.
|
|||
|
|
|
|||
|
|
--------------
|
|||
|
|
[The following section provides information relating to the behavior of
|
|||
|
|
the worm. This information was primarily supplied by Kevin Oberman of
|
|||
|
|
LLNL and John McMahon of GSFC]
|
|||
|
|
--------------
|
|||
|
|
|
|||
|
|
1. The program assures that it is working in a directory to which the owner
|
|||
|
|
(itself) has full access (Read, Write,Execute, and Delete).
|
|||
|
|
|
|||
|
|
2. The program checks to see if another copy is still running. It looks for a
|
|||
|
|
process with the first 5 characters of "NETW_". If such is found, it deletes
|
|||
|
|
itself (the file) and stops its process.
|
|||
|
|
|
|||
|
|
NOTE
|
|||
|
|
|
|||
|
|
This check is done using the F$GETJPI system service. The results
|
|||
|
|
vary depending on the amount of priviliges the account possesses.
|
|||
|
|
Non-priviliged accounts which are penetrated will only be able to
|
|||
|
|
return information about their own UIC, so multiple copies of the
|
|||
|
|
worm could be running simultaneously under different usernames.
|
|||
|
|
|
|||
|
|
|
|||
|
|
3. The program then changes the default DECNET account password to a random
|
|||
|
|
string of at least 12 characters.
|
|||
|
|
|
|||
|
|
4. Information on the infected node and account/password used to access the
|
|||
|
|
system is mailed to a central collection point on SPAN.
|
|||
|
|
|
|||
|
|
5. The process changes its name to "NETW_" followed by a random number.
|
|||
|
|
|
|||
|
|
6. It checks to see if it has SYSNAM priv. If so, it defines the system
|
|||
|
|
announcement message to be the WANK banner.
|
|||
|
|
|
|||
|
|
7. If it has SYSPRV, it disables mail to the SYSTEM account.
|
|||
|
|
|
|||
|
|
8. Also if it has SYSPRV, it modifies the system login command procedure
|
|||
|
|
(SYLOGIN.COM) to APPEAR to delete all of a user's files. (It really does
|
|||
|
|
nothing.)
|
|||
|
|
|
|||
|
|
9. The procedure then scans the accounts logical name table for symbols
|
|||
|
|
which contain directory specifications. Each directory located is searched
|
|||
|
|
for command procedures within it protected (W:RWED). Any such procedures
|
|||
|
|
have code inserted at the top which tries to modify the FIELD account to a
|
|||
|
|
known password with login from any source and all privs. This is a
|
|||
|
|
primitive virus, but very effective IF the procedure should be executed by
|
|||
|
|
a priviliged account.
|
|||
|
|
|
|||
|
|
10. It proceeds to attempt to access other systems by picking node numbers
|
|||
|
|
at random. It then used PHONE to get a list of active users on the remote
|
|||
|
|
system. It proceeds to irritate them by causing the PHONE object to send
|
|||
|
|
them a one-line "fortune cookie" type message. The appearance of this
|
|||
|
|
message does not indicate a penetration attempt on that node, more
|
|||
|
|
appropriately, it indicates an "irritation attempt".
|
|||
|
|
|
|||
|
|
NOTE
|
|||
|
|
If your site receives these PHONE messages the source node
|
|||
|
|
information can be found in the NETSERVER.LOG files in your DECnet
|
|||
|
|
default account.
|
|||
|
|
|
|||
|
|
11. The program tries to access the RIGHTSLIST.DAT file as previously
|
|||
|
|
described earlier.
|
|||
|
|
|
|||
|
|
12. It then steps through the list of usernames it has built and uses FAL
|
|||
|
|
to validate the candidate userid/password combination. If a password is
|
|||
|
|
guesses, the worm copies itself over to the target system and starts itself
|
|||
|
|
via the SUBMIT/REMOTE feature of VMS.
|
|||
|
|
|
|||
|
|
13. When the worm finishes with a system, it picks another random system and
|
|||
|
|
repeats (forever).
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
SECURITY GUIDELINES TO STOP THE SPREAD OF THIS WORM:
|
|||
|
|
====================================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
1. It is IMPERATIVE that all systems protect or remove the DECnet TASK 0
|
|||
|
|
object to prevent reoccurrance of this worm, OR MORE SERIOUS ATTACKS
|
|||
|
|
OF THIS KIND IN THE FUTURE!
|
|||
|
|
|
|||
|
|
The TASK object can be secured by either of the following methods:
|
|||
|
|
|
|||
|
|
Method 1):
|
|||
|
|
Issue the command:
|
|||
|
|
|
|||
|
|
NCP> CLEAR OBJECT TASK ALL
|
|||
|
|
|
|||
|
|
after the network is started up. This command can also be
|
|||
|
|
inserted into the procedure SYSTARTUP.COM (SYSTARTUP_V5.COM on V5.x
|
|||
|
|
systems) after the call to STARTNET.COM. In addition while the system
|
|||
|
|
is running, this command must be executed EACH TIME the network is
|
|||
|
|
restarted.
|
|||
|
|
|
|||
|
|
Method 2):
|
|||
|
|
Issue the following commands ONCE:
|
|||
|
|
|
|||
|
|
NCP> SET OBJECT TASK USER DECNET PASSWORD <a bunch of garbage>
|
|||
|
|
NCP> DEFINE OBJECT TASK USER DECNET PASSWORD <a bunch of garbage>
|
|||
|
|
|
|||
|
|
This causes a login failure to be generated whenever the TASK
|
|||
|
|
object is accessed. Once done, this change will be permanent.
|
|||
|
|
|
|||
|
|
NOTE
|
|||
|
|
We have received one report that TASK 0 is required
|
|||
|
|
for DECwindows. Read your documentation!
|
|||
|
|
|
|||
|
|
|
|||
|
|
2. Under NO circumstances it is acceptable for an account to have a
|
|||
|
|
password the same as the username. Passwords (passPHRASES) should be
|
|||
|
|
created so that they are difficult to guess, multi-word phrases are
|
|||
|
|
preferable. As a precaution, we recommend that all passwords be changed.
|
|||
|
|
Additionally, system managers may choose to revalidate ALL accounts.
|
|||
|
|
|
|||
|
|
If a system had the DECNET TASK 0 protected as above, the DECNET account
|
|||
|
|
protected against SUBMIT/REMOTE (described below) and no user had their
|
|||
|
|
userid as their password, it was immune to this WORM. As a result, the
|
|||
|
|
number of nodes actually INFECTED by this attack is relatively small. The
|
|||
|
|
number ATTACKED however, is large.
|
|||
|
|
|
|||
|
|
3. NETWORK ACCOUNTS
|
|||
|
|
To protect against the SUBMIT/REMOTE attack, run AUTHORIZE and make sure
|
|||
|
|
that all network account flags are set to NOBATCH, NODIALUP, NOLOCAL,
|
|||
|
|
and NOREMOTE.
|
|||
|
|
|
|||
|
|
4. FIELD ACCOUNT
|
|||
|
|
Make sure the FIELD ACCOUNT does not have the password FIELD. DISUSER the
|
|||
|
|
account. You must SEARCH all .COM files for a "field/remote/dialup". If
|
|||
|
|
the search shows it is in .COM files, They have a trojan horse appended
|
|||
|
|
to the files. When the .COM file is executed, This Trojan horse will try
|
|||
|
|
to reset account FIELD to /NODISUSER and password to FIELD. You should
|
|||
|
|
either delete the corrupted .COM file and obtain a good one elsewhere, or
|
|||
|
|
examine the file and remove the affected lines of the command procedure.
|
|||
|
|
|
|||
|
|
5. WORM FILES
|
|||
|
|
The WORM source files are W.COM or a single alphabetic character (C or D)
|
|||
|
|
followed by 4 or 5 numeric characters. (Cnnnnn.COM), ("nnnn" represents a
|
|||
|
|
random number). The WORM will start a process or processes running.
|
|||
|
|
These processes are named in format NETW_nnnn, and should be deleted.
|
|||
|
|
PHONE_nnnn may also be running as the WORM utilizes the PHONE object in
|
|||
|
|
an attempt to send a message to a user on another randomly selected node.
|
|||
|
|
|
|||
|
|
6. ALARMS
|
|||
|
|
Some alarms generated by the WORM are related to PHONE.EXE and FAL.EXE.
|
|||
|
|
The majority of the alarms are login failures as the WORM attempts to log
|
|||
|
|
into specific accounts.
|
|||
|
|
|
|||
|
|
We recommend that alarms be set immediately for logins, logouts, breakin
|
|||
|
|
attempts, modifications to the system and net UAF's, and to changes to
|
|||
|
|
user and system passwords.
|
|||
|
|
|
|||
|
|
|
|||
|
|
DISCOVERY AND CLEANUP
|
|||
|
|
----------------------
|
|||
|
|
|
|||
|
|
1. Log into a "privileged account"
|
|||
|
|
$ SHOW SYSTEM
|
|||
|
|
Look for NETW_dddd (dddd represents 4 or 5 random digits)
|
|||
|
|
IF NETW_dddd is found, note the process ID and do:
|
|||
|
|
$ STOP PROCESS/ID=NETW_dddd
|
|||
|
|
|
|||
|
|
The command procedure included below can be used by system
|
|||
|
|
managers to perform this function in the background. It is
|
|||
|
|
recommended that this procedure be run for the next week or
|
|||
|
|
so until the worm is killed-off.
|
|||
|
|
|
|||
|
|
2. Check the protection on all command procedures. If any are
|
|||
|
|
(W:REWD), check for infection. There should be two versions. The
|
|||
|
|
older one should be OK unless multiple infection has occurred.
|
|||
|
|
Generally the oldest version is OK but this is not guaranteed.
|
|||
|
|
|
|||
|
|
An easy method is to execute the command on every disk:
|
|||
|
|
|
|||
|
|
$SEARCH dev:[000000...]*.COM;* PASS=FIELD
|
|||
|
|
|
|||
|
|
Any infected files will contain the line:
|
|||
|
|
|
|||
|
|
$mcr authorize add field/remote/dialup/network/batch/defpriv=all
|
|||
|
|
/priv=all/flag=(nodisuser,nocaptive,nopwd_expire)/pass=field
|
|||
|
|
|
|||
|
|
3. Redefine or deassingn the SYS$ANNOUNCE logical name. Replace
|
|||
|
|
the correct SYS$ANNOUNCE messages. (Note the initial value of
|
|||
|
|
SYS$ANNOUNCE to identify the infected user account and location of
|
|||
|
|
the false announce message files (on infected systems only).
|
|||
|
|
|
|||
|
|
4. Clean up SYSLOGIN.COM. Remove the bogus file deletion routine.
|
|||
|
|
|
|||
|
|
5. Search all login directories for files named Cddddd.com or
|
|||
|
|
Dddddd.com. Dddddd.COM is a dummy file which precedes the actual
|
|||
|
|
infection. Cddddd.COM is the worm itself (normally both are
|
|||
|
|
deleted by the worm).
|
|||
|
|
|
|||
|
|
6. If your node is attacked or penetrated, please contact the SPAN
|
|||
|
|
Management immediately via MAIL or by phone. Send all messages
|
|||
|
|
to either NSSDCA::TENCATI or NSSDCA::NETMGR. If you do not have
|
|||
|
|
NSSDCA defined in your database, use the node number 6277::. We
|
|||
|
|
need to know which nodes have the worm running on them so we can
|
|||
|
|
coordinate cleanup measures with the appropriate personnel.
|
|||
|
|
|
|||
|
|
NOTE
|
|||
|
|
A tell-tale sign that your node was ATTACKED will be multiple
|
|||
|
|
login failure reports in your operator.log file.
|
|||
|
|
|
|||
|
|
|
|||
|
|
7. DO NOT DELETE ANY OF YOUR LOG FILES OR AUDIT TRAILS. THIS
|
|||
|
|
INFORMATION MAY BE REQUESTED OF YOU LATER IF THIS MATTER IS GOING
|
|||
|
|
TO BE PROSECUTED.
|
|||
|
|
|
|||
|
|
|
|||
|
|
PREVENTION MEASURES
|
|||
|
|
-------------------
|
|||
|
|
|
|||
|
|
1. Ensure all user accounts have good password management. (No
|
|||
|
|
"user user" or null passwords.)
|
|||
|
|
|
|||
|
|
2. No world READ command procedures in user or priviliged
|
|||
|
|
accounts.
|
|||
|
|
|
|||
|
|
3. No TASK objects.
|
|||
|
|
|
|||
|
|
4. Do not use the the account names as the password on network
|
|||
|
|
accounts. (Use the V5.2 approach - separate object userid's)
|
|||
|
|
|
|||
|
|
5. Ensure all network accounts are set NOBATCH, NOLOCAL, NODIALUP,
|
|||
|
|
and NOREMOTE and have a PRCLIM of 1.
|
|||
|
|
|
|||
|
|
6. Audit all changes by AUTHORIZE. Analyze audit trail for changes
|
|||
|
|
to the FIELD account.
|
|||
|
|
|
|||
|
|
7. Place an ALARM ACE on SYS$MANAGER:SYLOGIN.COM;* for
|
|||
|
|
WRITE+DELETE+SUCCESS access. Enable ACL auditing. Analyze the
|
|||
|
|
audit trail for change to SYLOGIN.COM.
|
|||
|
|
|
|||
|
|
8. Make sure ACCOUNTING and OPCOM are running and proper alarms
|
|||
|
|
are set.
|
|||
|
|
|
|||
|
|
9. Protect RIGHTSLIST.DAT against World access. Alternatively
|
|||
|
|
move or rename it and define the logical symbol RIGHTSLIST
|
|||
|
|
to the new file. ($DEF/SYS/EXEC RIGHTSLIST <renamed file>)
|
|||
|
|
This will limit the ability of the worm to determine
|
|||
|
|
actual valid usernames.
|
|||
|
|
----------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
The following command procedure was written by John McMahon at GSFC. It
|
|||
|
|
can be run as a batch job under a priviliged account. This procedure
|
|||
|
|
searches all processes on a running system to determine if the worm process
|
|||
|
|
is present. If detected, the worm is deleted.
|
|||
|
|
|
|||
|
|
|
|||
|
|
---------------------------- ANTIWANK.COM ----------------------------------
|
|||
|
|
$!
|
|||
|
|
$! Antiwank.Com - This program performs two functions. It kills any
|
|||
|
|
$! copy of the worm currently running (any process starting with NETW_
|
|||
|
|
$! in it's name) and disguises itself as a copy of the worm to help
|
|||
|
|
$! prevent new copies from being created.
|
|||
|
|
$!
|
|||
|
|
$! This program should be submitted to a batch queue under the username
|
|||
|
|
$! SYSTEM. It requires WORLD priv to check the process names on your
|
|||
|
|
$! CPU. It runs continuously, but uses little overhead.
|
|||
|
|
$!
|
|||
|
|
$! This program uses the process name "NETW_AntiWank". It should not be
|
|||
|
|
$! confused as a copy of the worm program itself (which uses
|
|||
|
|
$! NETW_randomnumber).
|
|||
|
|
$!
|
|||
|
|
$! The system manager should add additional userids to the line
|
|||
|
|
$! beginning with SEND_MAIL_TO. If the program detects the worm,
|
|||
|
|
$! it will send a detection message to the userids in SEND_MAIL_TO.
|
|||
|
|
$!
|
|||
|
|
$! John McMahon
|
|||
|
|
$! NASA/GSFC CODE 630.4
|
|||
|
|
$!
|
|||
|
|
$! 18-OCT-1989 16:11:56.21
|
|||
|
|
$!
|
|||
|
|
$! SPAN: SDCDCL::FASTEDDY
|
|||
|
|
$! Internet: Fasteddy@Dftnic.Gsfc.Nasa.Gov
|
|||
|
|
$! Bitnet: Fasteddy@Dftbit
|
|||
|
|
$!
|
|||
|
|
$! Phone: 301-286-2045
|
|||
|
|
$!
|
|||
|
|
$ Set NoON
|
|||
|
|
$ AntiWank_Name = "NETW_AntiWank"
|
|||
|
|
$ Process_Name_Prefix = "NETW_"
|
|||
|
|
$ Send_Mail_To = "SYSTEM"
|
|||
|
|
$ Set Process/Priv=(World)
|
|||
|
|
$ Set Process/Name="''AntiWank_Name'"
|
|||
|
|
$ Start:
|
|||
|
|
$ Context = ""
|
|||
|
|
$ Pid_Loop:
|
|||
|
|
$ Check_Pid = F$Pid(Context)
|
|||
|
|
$ If Check_Pid .Eqs. "" Then Goto End_Pid_Loop
|
|||
|
|
$ Check_Prcnam = F$Edit(F$Getjpi(Check_Pid,"PRCNAM"),"TRIM")
|
|||
|
|
$ Write Sys$Output "Process Name: ",Check_Prcnam
|
|||
|
|
$ If Check_Prcnam .Eqs. AntiWank_Name Then Goto Pid_Loop
|
|||
|
|
$ If F$Extract(0,5,Check_Prcnam) .Eqs. Process_Name_Prefix Then -
|
|||
|
|
Gosub Action_Routine
|
|||
|
|
$ Goto Pid_Loop
|
|||
|
|
$!
|
|||
|
|
$ End_Pid_Loop:
|
|||
|
|
$ Write Sys$Output F$TIME()," ANTIWANK is still working for you"
|
|||
|
|
$ Wait 00:10:00
|
|||
|
|
$ Goto Start
|
|||
|
|
$!
|
|||
|
|
$ Action_Routine:
|
|||
|
|
$ Write Sys$Output "Action Routine"
|
|||
|
|
$ Username = F$Getjpi(Check_Pid,"Username")
|
|||
|
|
$ Stop/Id='Check_Pid'
|
|||
|
|
$ Mail NL: 'Send_Mail_To' -
|
|||
|
|
/SUBJECT="Worm Terminated ''$Status' ''Check_Prcnam' ''Check_Pid' ''Username'"
|
|||
|
|
YES
|
|||
|
|
$ Return
|
|||
|
|
---------------------------END OF ANTIWANK.COM-------------------------
|
|||
|
|
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|