Trojan TR/agent 801696

netsvcs 
drivers32 
SAVEMBR:0 
/md5start
volsnap.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%temp%\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.
%APPDATA%\*.exe /s 
%APPDATA%\*.
%SYSTEMDRIVE%\*.exe 
%systemroot%\*. /mp /s 
%systemroot%\system32\*.dll /lockedfiles 
%systemroot%\Tasks\*.job /lockedfiles 
%systemroot%\system32\drivers\*.sys /lockedfiles 
hklm\system\CurrentControlSet\Control\Session Manager\SubSystems /s 
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT 

netsvcs 
drivers32 
SAVEMBR:0 
/md5start
volsnap.*
explorer.exe
winlogon.exe
userinit.exe
svchost.exe
/md5stop
%temp%\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.
%APPDATA%\*.exe /s 
%APPDATA%\*.
%SYSTEMDRIVE%\*.exe 
%systemroot%\*. /mp /s 
%systemroot%\system32\*.dll /lockedfiles 
%systemroot%\Tasks\*.job /lockedfiles 
%systemroot%\system32\drivers\*.sys /lockedfiles 
hklm\system\CurrentControlSet\Control\Session Manager\SubSystems /s 
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs

C:\Documents and Settings\bob\Mes documents\Téléchargements

Iadah Toolbar
Messenger Plus Live Toolbar
OfferBox

:OTL
IE - HKCU\..\URLSearchHook: {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\prxtbMes2.dll (Conduit Ltd.)     
FF - prefs.js..browser.search.defaultthis.engineName: "Messenger Plus Live Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2124320&SearchSource=3&q={searchTerms}" 
FF - prefs.js..extensions.enabledItems: toolbar@iadah.com:1.04 
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2124320&q=" 
FF - HKLM\software\mozilla\Firefox\extensions\\offerboxffx@offerbox.com: C:\Program Files\OfferBox\offerboxffx@offerbox.com [2011/04/27 00:26:32 | 000,000,000 | ---D | M]     
[2010/03/27 02:10:58 | 000,000,000 | ---D | M] (Messenger Plus Live Toolbar) -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\amkk4zdj.default\extensions\{9b339f6e-ddcd-401b-8764-230adbd01761}     
[2010/09/08 13:15:07 | 000,000,000 | ---D | M] (No name found) -- 
[2010/12/23 22:49:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\amkk4zdj.default\extensions\{f4e6547e-325b-403c-a3bb-ad29ed37a92f}     
[2010/12/23 22:49:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\amkk4zdj.default\extensions\engine@conduit.com 
[2011/01/08 20:52:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\amkk4zdj.default\extensions\toolbar@iadah.com 
[2010/03/26 14:26:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\Mozilla\Firefox\Profiles\amkk4zdj.default\extensions\toolbar@waltershop.com 
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)     
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)     
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.     
O2 - BHO: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\prxtbMes2.dll (Conduit Ltd.)     
O2 - BHO: (OfferBox) - {FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} - C:\Program Files\OfferBox\OfferBoxBHO.dll (Secure Digital Services Limited)    
O3 - HKLM\..\Toolbar: (Iadah Toolbar) - {3EA8D036-C9E7-4721-BCDF-C13D00C4CC39} - C:\Program Files\DevNet\Toolbar\DevNet.dll (DevNet)     
O3 - HKLM\..\Toolbar: (Messenger Plus Live Toolbar) - {9b339f6e-ddcd-401b-8764-230adbd01761} - C:\Program Files\Messenger_Plus_Live\prxtbMes2.dll (Conduit Ltd.)     
O3 - HKCU\..\Toolbar\WebBrowser: (Messenger Plus Live Toolbar) - {9B339F6E-DDCD-401B-8764-230ADBD01761} - C:\Program Files\Messenger_Plus_Live\prxtbMes2.dll (Conduit Ltd.) 
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)     
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] 
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] 
[2011/05/12 15:18:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\bob\Application Data\OfferBox     
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 

:Files
ipconfig /flushdns /c
C:\Documents and Settings\bob\Application Data\OfferBox     

:Commands 
[resethosts]
[emptyflash]
[emptytemp]