start
CreateRestorePoint:
CloseProcesses:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.exlee.com/?f=1&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.exlee.com/?f=1&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906
HKU\S-1-5-21-901587214-2200967626-3004657440-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.exlee.com/?f=1&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.exlee.com/results.php?f=4&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.exlee.com/results.php?f=4&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906&q={searchTerms}
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKU\S-1-5-21-901587214-2200967626-3004657440-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.exlee.com/results.php?f=4&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906&q={searchTerms}
SearchScopes: HKU\S-1-5-21-901587214-2200967626-3004657440-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.exlee.com/results.php?f=4&a=xle_installertech_16_25&cd=2XzuyEtN2Y1L1QzutAzz0E0A0AyB0E0BtAtCyE0F0Czz0B0EtN0D0Tzu0StCyCtAyDtN1L2XzutAtFtBtCtFtDtFtDtN1L1Czu2V1I1P1V1L1G1B2Z1T1I1I1P1C2Z1P1R1MtN1L1G1B1V1N2Y1L1Qzu2SyEyC0Czzzzzy0AtCtGyC0EyByCtGyCtD0CyBtGyB0DtA0CtG0AtDtA0EtB0E0CyBzy0DtA0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EyD0FtCtDtAtByCtGtByEzy0CtGyE0DtA0EtG0A0D0EtAtGtC0B0FtDyE0DyD0E0F0AyE0D2QtN0A0LzuyE&cr=1080946906&q={searchTerms}
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2016-06-22] (Oracle Corporation)
FF Plugin: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-06-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2016-06-22] (Oracle Corporation)
FF HKLM-x32\...\Firefox\Extensions: [{94285e43-a27b-4f51-b280-00763ae7cd81}] - C:\Users\oldman\AppData\Roaming\Mozilla\Firefox\{94285e43-a27b-4f51-b280-00763ae7cd81}.xpi => not found
CHR DefaultSuggestURL: Default -> hxxp://ss-sym.ask.com/query?q={searchTerms}&sstype=prefix&li=ff
2016-06-23 22:40 - 2016-06-25 19:43 - 00000000 ____D C:\Program Files (x86)\SafeSavings
2016-06-23 22:40 - 2016-06-23 22:40 - 00000000 ____D C:\ProgramData\SafeSavings
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-901587214-2200967626-3004657440-1003_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\oldman\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
EmptyTemp:
End