:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [URL="http://search.chatzum.com/"]Nation Search[/URL]
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzutDtDtByEtBtCyDyEtA0CtD0CyCtAyE0BtN0D0TzutBtDtCtBtDyCtCtC&cr=1793258079
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://search.chatzum.com/?q={searchTerms}
IE - HKU\S-1-5-21-1409082233-1757981266-839522115-1003\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
IE - HKU\S-1-5-21-1409082233-1757981266-839522115-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=12234
IE - HKU\S-1-5-21-1409082233-1757981266-839522115-1003\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://search.chatzum.com/?q={SearchTerms}
IE - HKU\S-1-5-21-1409082233-1757981266-839522115-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3244149
FF - prefs.js..browser.search.defaultenginename: "Funmoods"
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentBar_IT Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2851640&SearchSource=3&q={searchTerms}"
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Programmi\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm File not found
O8 - Extra context menu item: Translate with Babylon - res://C:\Programmi\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm File not found
FF - prefs.js..extensions.enabledItems: {4619105f-8f56-4dc3-bb47-ede6e2993355}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {9b339f6e-ddcd-401b-8764-230adbd01761}:2.7.2.0
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2851640&SearchSource=13"
FF - prefs.js..backup.old.browser.search.selectedEngine: "uTorrentBar_IT Customized Web Search"
FF - prefs.js..backup.old.browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultenginename: "Funmoods"
[2011/01/18 19.35.57 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\extensions\engine@conduit.com
[2012/10/08 18.05.12 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\extensions\ffxtlbr@funmoods.com
[2012/06/11 20.03.00 | 000,000,000 | ---D | M] (Yontoo) -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\extensions\plugin@yontoo.com
[2012/10/08 18.10.46 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\extensions\support@predictad.com
[2010/09/03 14.18.05 | 000,001,681 | ---- | M] () -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\searchplugins\ask.uk.xml
[2011/01/18 19.35.56 | 000,000,931 | ---- | M] () -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\searchplugins\conduit.xml
[2012/10/08 18.05.09 | 000,000,789 | ---- | M] () -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\searchplugins\Funmoods.xml
[2010/02/05 17.06.44 | 000,009,985 | ---- | M] () -- C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\isewmkfb.default\searchplugins\mywebsearch.xml
[2010/10/21 21.25.23 | 000,002,226 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\babylon.xml
[2011/11/15 17.08.09 | 000,002,048 | ---- | M] () -- C:\Programmi\mozilla firefox\searchplugins\fcmdSrch.xml
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programmi\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar) - {41564952-412D-5637-4300-7A786E7484D7} - C:\Programmi\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar) - {41564952-412D-5637-4300-7A786E7484D7} - C:\Programmi\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programmi\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar) - {41564952-412D-5637-4300-7A786E7484D7} - C:\Programmi\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll (APN LLC.)
O4 - HKLM..\Run: [ApnTBMon] C:\Programmi\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)
O8 - Extra context menu item: Translate with Babylon - res://C:\Programmi\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm File not found
O33 - MountPoints2\{61b1ac60-0df5-11e2-b0b0-002421543c0c}\Shell - "" = AutoRun
O33 - MountPoints2\{61b1ac60-0df5-11e2-b0b0-002421543c0c}\Shell\AutoRun\command - "" = E:\LGAutoRun.exe
O33 - MountPoints2\{6dd7002c-06ed-11e0-bc47-002421543c0c}\Shell\AutoRun\command - "" = E:\installer.exe
O33 - MountPoints2\{85f63cc0-d7ac-11e0-bceb-002421543c0c}\Shell - "" = AutoRun
O33 - MountPoints2\{85f63cc0-d7ac-11e0-bceb-002421543c0c}\Shell\AutoRun\command - "" = G:\unlock.exe autoplay=true
O33 - MountPoints2\{fb23ac92-4cbe-11e0-bc8d-002421543c0c}\Shell - "" = AutoRun
O33 - MountPoints2\{fb23ac92-4cbe-11e0-bc8d-002421543c0c}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
[2014/02/11 13.07.37 | 000,000,000 | ---D | C] -- C:\Programmi\AskPartnerNetwork
[2014/02/11 13.07.37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dati applicazioni\AskPartnerNetwork
[2014/02/11 13.07.36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Conduit
[2014/02/11 13.07.02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\ConduitEngine
[2010/12/11 23.37.18 | 000,000,027 | ---- | C] () -- C:\Documents and Settings\utente\.mjsync_it_IT
[2012/02/23 10.46.11 | 000,000,075 | ---- | C] () -- C:\WINDOWS\rar_crck.ini
[2014/02/11 13.06.44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\APN
[2014/02/11 13.07.37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\AskPartnerNetwork
[2014/01/31 16.38.03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dati applicazioni\ParetoLogic
[2012/10/29 10.51.45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\utente\Dati applicazioni\Funmoods
[2012/03/17 21.34.07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\utente\Dati applicazioni\Leawo
2012/03/27 18.04.40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\utente\Dati applicazioni\searchquband [MENTION=102884]alt[/MENTION]ernate Data Stream - 841 bytes -> C:\Documents and Settings\All Users\Dati applicazioni\TEMP:35E5AF34 [MENTION=102884]alt[/MENTION]ernate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Dati applicazioni\TEMP:0B4227B4 [MENTION=102884]alt[/MENTION]ernate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Dati applicazioni\TEMP:80E965A3
:Files
ipconfig /flushdns /c
:commands
[purity]
[Reboot]