Leonedes C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\UsrClass.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\UsrClass.dat was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\ADSAdClient31[9].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\ADSAdClient31[9].txt was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\5FECA490d01 was created. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache was modified. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\01[1].htm was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\01[1].htm was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\5FECA490d01 was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\5FECA490d01 was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\01[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010010220100103\index.dat was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\23AA53AAd01 was created. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\ADSAdClient31[10].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9 was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\23AA53AAd01 was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\776-W-MS-7;dst=1;et=1262434799427;tzo=-120;a=p-0dhxSnEnsEt72;media=ad;labels=_imp.adserver.atlas%2C_imp.publisher.135900953%2C_imp.creative.119923214.140758775[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\776-W-MS-7;dst=1;et=1262434799427;tzo=-120;a=p-0dhxSnEnsEt72;media=ad;labels=_imp.adserver.atlas%2C_imp.publisher.135900953%2C_imp.creative.119923214.140758775[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9 was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\places.sqlite-journal was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\places.sqlite-journal was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\places.sqlite was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\places.sqlite-journal was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\whatsnewservice[1].asmx was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\whatsnewservice[1].asmx was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\whatsnewservice[1].asmx was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\whatsnewservice[1].asmx was modified. C:\Users\Mark\AppData\Local\Microsoft\Messenger\mark.assad@hotmail.com\SocialNews\WNResponse.xml was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\sessionstore-2.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\prefs-1.js was created. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\prefs-1.js was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\AppData\Local\Mozilla\Firefox\Profiles\yyqbq4t0.default\Cache\_CACHE_003_ was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default\parent.lock was removed. C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\yyqbq4t0.default was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\Documents\My Received Files\mark.assad1865677532\History\diwi191718806434.xml was modified. C:\Windows\Temp\TMP0000002A6D5E607F478F0E5E was created. C:\Windows\Temp\TMP0000002A6D5E607F478F0E5E was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\01[1].htm was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJ416AC9\ADSAdClient31[9].txt was removed. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-C6CFE2A8.pf was modified. C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-10E4267C.pf was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6B49B524-F799-11DE-AAAF-001676E502F8}.dat was created. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6B49B524-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\IECompatCache\Low\index.dat was modified. C:\Users\Mark\AppData\Local\Temp\~DFD0B9625CE359DA70.TMP was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\msn_com[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\msn_com[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\msn_com[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\PrivacIE\Low\index.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\IETldCache\Low\index.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\msn_com[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\CC891224D3DA3EE078BBF91AD935E[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\CC891224D3DA3EE078BBF91AD935E[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ECE3DF4F7E259C78D5ABD5AFE4876[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ECE3DF4F7E259C78D5ABD5AFE4876[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\ADSAdClient31[5].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ADSAdClient31[8].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\ADSAdClient31[6].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\ADSAdClient31[6].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\ADSAdClient31[6].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADBD89C57FF3D9775C45E2B1440E1[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADBD89C57FF3D9775C45E2B1440E1[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADSAdClient31[6].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\ADSAdClient31[11].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\ADSAdClient31[11].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\05190D61CE9A4BAF222E8AAF752[1].jpg was modified. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ADSAdClient31[11].txt was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\05190D61CE9A4BAF222E8AAF752[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ADSAdClient31[10].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ADSAdClient31[10].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\196[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\010110-NCAA-FB-Florida-Victory-JW_20100102002859_70_70[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\ADSAdClient31[6].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\9F3ACEC4BF7D1BEC561EB2BA223592[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADBD89C57FF3D9775C45E2B1440E1[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ADSAdClient31[9].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ADSAdClient31[9].txt was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@ad.wsod[1].txt was removed. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\196[1].gif was modified. C:\Users\Mark\AppData\Local\Temp\StructuredQuery.log was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\transparent[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\transparent[1].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADSAdClient31[7].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADSAdClient31[7].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADSAdClient31[7].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\196[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ADSAdClient31CA0XNECL.txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\257[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\257[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ADBD89C57FF3D9775C45E2B1440E1[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\CC891224D3DA3EE078BBF91AD935E[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010010220100103\index.dat was modified. C:\Users\Mark\AppData\Local\Temp\StructuredQuery.log was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@analytics.live[1].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\atanid[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX was modified. C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2D.pf was modified. C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2D.pf was modified. C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2D.pf was modified. C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2D.pf was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5 was modified. C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log was modified. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50ERBUC1\ADSAdClient31[8].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50ERBUC1\ADSAdClient31[8].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50ERBUC1 was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48C226A0FE7D97DE1C716B47235CB639_339FE4A15083BA9D58F96C1443F0D4C4 was created. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48C226A0FE7D97DE1C716B47235CB639_339FE4A15083BA9D58F96C1443F0D4C4 was modified. C:\Users\Mark\AppData\Local\Temp\Low\CabA4E.tmp was created. C:\Users\Mark\AppData\Local\Temp\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLogin[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLogin[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLogin[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\google_transparent[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\google_transparent[1].gif was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0F063B6B88A2B8BFE21C3993A613447 was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\google_transparent[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\urchin[1].js was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\urchin[1].js was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\urchin[1].js was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F74056C561F814B7771CB2993A44DEB was created. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F74056C561F814B7771CB2993A44DEB was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\login_features_sprite[1].png was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\login_corners_sprite[1].png was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\logo2[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\greybtn[1].png was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\login_features_sprite[1].png was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\c[1].gif was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48C226A0FE7D97DE1C716B47235CB639_339FE4A15083BA9D58F96C1443F0D4C4 was modified. C:\Users\Mark\AppData\Local\Temp\Tar3FC0.tmp was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\50ERBUC1\favicon[2].ico was created. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48C226A0FE7D97DE1C716B47235CB639_DC3ECA18B04A2937A5690E2E2A52A013 was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0EBB3788D77094423275558212CCE7B1 was modified. C:\Users\Mark\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0EBB3788D77094423275558212CCE7B1 was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].htm was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was removed. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\c[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].htm was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\c[1].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[8].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\c[2].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\c[2].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\Captcha[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\accessibility[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\accessibility[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\accessibility[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[1].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[9].txt was removed. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[9].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[8].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[2].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[2].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[1].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[1].jpg was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\c[1].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\c[1].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[8].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\Captcha[1].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[2].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[2].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[2].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[2].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[2].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4RX5DO4XGAHJPI3Y8G5S.temp was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4RX5DO4XGAHJPI3Y8G5S.temp was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[2].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[2].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].htm was created. C:\Windows\System32\config\SYSTEM.LOG1 was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Windows\System32\config\SYSTEM was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[2].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[2].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[3].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[3].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[9].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[2].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[2].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[2].jpg was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\c[2].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M52UMDGO\ServiceLoginAuth[1].htm was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[8].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[3].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VJUF2BD0\c[3].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\ServiceLoginAuth[1].txt was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[5].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[3].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[3].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\6JA4EFM8\Captcha[3].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[3].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[3].gif was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\HIIYB9FM\c[3].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[9].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[3].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\9F9NS9UG\Captcha[3].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[4].gif was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\97MR7WM1\c[4].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6B49B525-F799-11DE-AAAF-001676E502F8}.dat was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\ServiceLoginAuth[1].txt was created. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low\mark@google[8].txt was removed. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[3].jpg was created. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[3].jpg was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3U0ZDV4F\Captcha[3].jpg was modified. C:\Users\Mark\ntuser.dat.LOG1 was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\NTUSER.DAT was modified. C:\Users\Mark\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GN8IWIIX\c[3].gif was modified. C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Cookies\Low was modified.
Padre WTF is that ? :P at least give some details ! i never worked under Vista but i might wanna take a look @ : C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\MpCmdRun.log was modified.
J4D you can find some anti key logging software on the interwebs , but i don't know the validity of those.
Leonedes they work ... but not like everything .. thats the only way to find out, watch what was modified during few seconds >_> and i have this paranoia about keyloggers so ... recommend something else ?
Padre not all key loggers directly write to the HDD :S some write every minute, or every hour. the one i wrote, never writes :P simply send me an email every X amount of characters typed , or when the the process is instructed to shutdown without having to write anything on the disk. About detecting them, well that will depend on how it was written, they mostly hook the Keyboard api call, you can check for who's hooking what. But some dont even hook that and are harder to spot. for example if i'm aiming at stealing login credentials, i would simply inject a dll into your browser and hook a few functions there and the trick is done :D (ssl and the lot wont help u there :P)
mir use on screen keyboard for typing passwords if you are paranoid if you have kaspersky, they will put link to a virtual keyboard in ur browsers if i cared enough, i would write something that scrambles my keyboard input and then fixes it before submitting it like a middle layer to avoid keyloggers and in case of hardware keyloggers, i don't think u can detect them from checking files. fa khidlak ba2a :P you are not sekiourrrr ... and never will be * scary sound * :P
arithma Try to scare the keylogger by typing scary things back. "I feel I am being watched. I can see them in my dreams. I dream of killing them. Their blood on my hands...CTRL-SAVE" -- simulated diary to scare the keylogger away "Hey there, been a while" -- a conversation
crazy You can use the solution mir provided, google keyscrambler. It scrambles your input and adjust it before processing it in the textbox. If you have a keylogger well he will read jibberish, and you'll be safe. But any spyware/malware detector would help you delete it if it exists. Crazy
Leonedes hahahaha @ all :P well i have formed some kind of paranoia :p but then again im paranoic of everything so meh nevermind, i was only just wondering 8-) Thanks for the info though =)