Infection, désinfection, infection... rapports joints

Bon, je ne sais pas faire remonter un topic. Quelqu'un pourrait-il m'expliquer pour la prochaine fois ?
Mon infection continue :
- J'ai lancé Look2Me-Destroyer,
- puis L2Mfix
- Je suis passé en mode sans échec ; j'ai utilisé Ccleaner,
- Easycleaner, puis Ccleaner à nouveau,
- J'ai viré des lignes moches avec HighJackThis,
- J'ai fait un scan puis un nettoyage avec un Ewido mis à jour.
Et je commence ma nouvelle session accueilli par une invite Errorsafe...
Je sais que j'en ai trop fait d'un côté, pas assez de l'autre. Aidez-moi quand vous aurez un moment.
Rapports L2Mfix, Ewido et HighJackThis :

Log L2Mfix :

L2mfix 010406
Creating Account.
La commande s'est termin‚e correctement.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1016 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1088 'winlogon.exe'
Killing PID 1088 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 952 'explorer.exe'
Killing PID 952 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
1 fichier(s) copi‚(s).
Deleting: C:\WINDOWS\system32\EKENT.DLL
Successfully Deleted: C:\WINDOWS\system32\EKENT.DLL
Deleting: C:\WINDOWS\system32\MQR.DLL
Successfully Deleted: C:\WINDOWS\system32\MQR.DLL
Deleting: C:\WINDOWS\system32\UARLBVA.DLL
Successfully Deleted: C:\WINDOWS\system32\UARLBVA.DLL
Deleting: C:\WINDOWS\system32\UHBMON.DLL
Successfully Deleted: C:\WINDOWS\system32\UHBMON.DLL

msg11?.dll
0 fichier(s) copi‚(s).



Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\EKENT.DLL
C:\WINDOWS\system32\MQR.DLL
C:\WINDOWS\system32\UARLBVA.DLL
C:\WINDOWS\system32\UHBMON.DLL

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\ID]
@="{5FA37EB6-4523-4228-883C-F9A9770D0477}"

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\IDex]
@="VT00"

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\InprocServer32]
@="C:\\WINDOWS\\system32\\AsTIVEDS.DLL"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}\Version]
@="126"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}\InprocServer32]
@="C:\\WINDOWS\\system32\\MCN601N.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}\InprocServer32]
@="C:\\WINDOWS\\system32\\MTXML3R.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A034624B-FB73-47E8-9DA7-03838A336035}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A034624B-FB73-47E8-9DA7-03838A336035}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A034624B-FB73-47E8-9DA7-03838A336035}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A034624B-FB73-47E8-9DA7-03838A336035}\InprocServer32]
@="C:\\WINDOWS\\system32\\PHTOREC.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}\InprocServer32]
@="C:\\WINDOWS\\system32\\STELL32.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{425E7C02-FF12-4672-A3D9-0736F5FA458D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{425E7C02-FF12-4672-A3D9-0736F5FA458D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{425E7C02-FF12-4672-A3D9-0736F5FA458D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{425E7C02-FF12-4672-A3D9-0736F5FA458D}\InprocServer32]
@="C:\\WINDOWS\\system32\\IJAGEHLP.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{027F3F65-FC28-4FF4-A59D-72C07674AA11}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{027F3F65-FC28-4FF4-A59D-72C07674AA11}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{027F3F65-FC28-4FF4-A59D-72C07674AA11}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{027F3F65-FC28-4FF4-A59D-72C07674AA11}\InprocServer32]
@="C:\\WINDOWS\\system32\\WSBVW.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0871D59D-D4D3-475A-A66E-0EF37300E9CF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0871D59D-D4D3-475A-A66E-0EF37300E9CF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0871D59D-D4D3-475A-A66E-0EF37300E9CF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0871D59D-D4D3-475A-A66E-0EF37300E9CF}\InprocServer32]
@="C:\\WINDOWS\\system32\\MXDEMUI.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A9125DEE-615C-45B6-AE55-A679EC8150C4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9125DEE-615C-45B6-AE55-A679EC8150C4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9125DEE-615C-45B6-AE55-A679EC8150C4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9125DEE-615C-45B6-AE55-A679EC8150C4}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}\InprocServer32]
@="C:\\WINDOWS\\system32\\MURMSG.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{835811D5-865F-4E3A-8C7F-2B20E0C9A424}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{835811D5-865F-4E3A-8C7F-2B20E0C9A424}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{835811D5-865F-4E3A-8C7F-2B20E0C9A424}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{835811D5-865F-4E3A-8C7F-2B20E0C9A424}\InprocServer32]
@="C:\\WINDOWS\\system32\\mnjetoledb40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A114182A-BB3A-411F-BB15-0B0A58EB4220}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A114182A-BB3A-411F-BB15-0B0A58EB4220}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A114182A-BB3A-411F-BB15-0B0A58EB4220}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A114182A-BB3A-411F-BB15-0B0A58EB4220}\InprocServer32]
@="C:\\WINDOWS\\system32\\BADISPL.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}\InprocServer32]
@="C:\\WINDOWS\\system32\\SCDOCLC.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C4BE4370-E044-4D76-8141-D04462401B60}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C4BE4370-E044-4D76-8141-D04462401B60}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C4BE4370-E044-4D76-8141-D04462401B60}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C4BE4370-E044-4D76-8141-D04462401B60}\InprocServer32]
@="C:\\WINDOWS\\system32\\MXIHND.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1A3B796E-F866-457A-845B-0FDEA8A321FB}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{1A3B796E-F866-457A-845B-0FDEA8A321FB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1A3B796E-F866-457A-845B-0FDEA8A321FB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1A3B796E-F866-457A-845B-0FDEA8A321FB}\InprocServer32]
@="C:\\WINDOWS\\system32\\SGRWVDRV.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}\InprocServer32]
@="C:\\WINDOWS\\system32\\UARLBVA.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9817B30C-49DF-4076-9AC2-EB21F61A071F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9817B30C-49DF-4076-9AC2-EB21F61A071F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9817B30C-49DF-4076-9AC2-EB21F61A071F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9817B30C-49DF-4076-9AC2-EB21F61A071F}\InprocServer32]
@="C:\\WINDOWS\\system32\\EKENT.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F432B8CF-3FE8-45CC-90E8-927B41697F12}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F432B8CF-3FE8-45CC-90E8-927B41697F12}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F432B8CF-3FE8-45CC-90E8-927B41697F12}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F432B8CF-3FE8-45CC-90E8-927B41697F12}\InprocServer32]
@="C:\\WINDOWS\\system32\\UHBMON.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{ED9750DD-F35F-45FC-AD31-80502AE52437}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED9750DD-F35F-45FC-AD31-80502AE52437}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED9750DD-F35F-45FC-AD31-80502AE52437}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED9750DD-F35F-45FC-AD31-80502AE52437}\InprocServer32]
@="C:\\WINDOWS\\system32\\MQR.DLL"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}"=-
"{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}"=-
"{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}"=-
"{A034624B-FB73-47E8-9DA7-03838A336035}"=-
"{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}"=-
"{425E7C02-FF12-4672-A3D9-0736F5FA458D}"=-
"{027F3F65-FC28-4FF4-A59D-72C07674AA11}"=-
"{0871D59D-D4D3-475A-A66E-0EF37300E9CF}"=-
"{A9125DEE-615C-45B6-AE55-A679EC8150C4}"=-
"{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}"=-
"{835811D5-865F-4E3A-8C7F-2B20E0C9A424}"=-
"{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}"=-
"{A114182A-BB3A-411F-BB15-0B0A58EB4220}"=-
"{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}"=-
"{C4BE4370-E044-4D76-8141-D04462401B60}"=-
"{1A3B796E-F866-457A-845B-0FDEA8A321FB}"=-
"{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}"=-
"{9817B30C-49DF-4076-9AC2-EB21F61A071F}"=-
"{F432B8CF-3FE8-45CC-90E8-927B41697F12}"=-
"{ED9750DD-F35F-45FC-AD31-80502AE52437}"=-
[-HKEY_CLASSES_ROOT\CLSID\{A22039C0-C45C-4CAA-8DA9-88F26DF065D9}]
[-HKEY_CLASSES_ROOT\CLSID\{CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548}]
[-HKEY_CLASSES_ROOT\CLSID\{FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C}]
[-HKEY_CLASSES_ROOT\CLSID\{A034624B-FB73-47E8-9DA7-03838A336035}]
[-HKEY_CLASSES_ROOT\CLSID\{B74F18C8-F252-406B-9B1B-D8B0FC279BE2}]
[-HKEY_CLASSES_ROOT\CLSID\{425E7C02-FF12-4672-A3D9-0736F5FA458D}]
[-HKEY_CLASSES_ROOT\CLSID\{027F3F65-FC28-4FF4-A59D-72C07674AA11}]
[-HKEY_CLASSES_ROOT\CLSID\{0871D59D-D4D3-475A-A66E-0EF37300E9CF}]
[-HKEY_CLASSES_ROOT\CLSID\{A9125DEE-615C-45B6-AE55-A679EC8150C4}]
[-HKEY_CLASSES_ROOT\CLSID\{C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF}]
[-HKEY_CLASSES_ROOT\CLSID\{835811D5-865F-4E3A-8C7F-2B20E0C9A424}]
[-HKEY_CLASSES_ROOT\CLSID\{0FE0B66E-3596-41D7-8033-6EE9D805E0C0}]
[-HKEY_CLASSES_ROOT\CLSID\{A114182A-BB3A-411F-BB15-0B0A58EB4220}]
[-HKEY_CLASSES_ROOT\CLSID\{FAB9C3D9-59ED-46B1-A179-B6B77BF938D0}]
[-HKEY_CLASSES_ROOT\CLSID\{C4BE4370-E044-4D76-8141-D04462401B60}]
[-HKEY_CLASSES_ROOT\CLSID\{1A3B796E-F866-457A-845B-0FDEA8A321FB}]
[-HKEY_CLASSES_ROOT\CLSID\{3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B}]
[-HKEY_CLASSES_ROOT\CLSID\{9817B30C-49DF-4076-9AC2-EB21F61A071F}]
[-HKEY_CLASSES_ROOT\CLSID\{F432B8CF-3FE8-45CC-90E8-927B41697F12}]
[-HKEY_CLASSES_ROOT\CLSID\{ED9750DD-F35F-45FC-AD31-80502AE52437}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/EKENT.DLL (164 bytes security) (deflated 4%)
adding: dlls/MQR.DLL (164 bytes security) (deflated 4%)
adding: dlls/UARLBVA.DLL (164 bytes security) (deflated 4%)
adding: dlls/UHBMON.DLL (164 bytes security) (deflated 4%)
adding: backregs/027F3F65-FC28-4FF4-A59D-72C07674AA11.reg (212 bytes security) (deflated 70%)
adding: backregs/0871D59D-D4D3-475A-A66E-0EF37300E9CF.reg (212 bytes security) (deflated 70%)
adding: backregs/0FE0B66E-3596-41D7-8033-6EE9D805E0C0.reg (212 bytes security) (deflated 70%)
adding: backregs/1A3B796E-F866-457A-845B-0FDEA8A321FB.reg (212 bytes security) (deflated 69%)
adding: backregs/3E06C19A-E8DA-43B6-860D-2AAD55DAEA1B.reg (212 bytes security) (deflated 70%)
adding: backregs/425E7C02-FF12-4672-A3D9-0736F5FA458D.reg (212 bytes security) (deflated 70%)
adding: backregs/835811D5-865F-4E3A-8C7F-2B20E0C9A424.reg (212 bytes security) (deflated 70%)
adding: backregs/9817B30C-49DF-4076-9AC2-EB21F61A071F.reg (212 bytes security) (deflated 70%)
adding: backregs/A034624B-FB73-47E8-9DA7-03838A336035.reg (212 bytes security) (deflated 70%)
adding: backregs/A114182A-BB3A-411F-BB15-0B0A58EB4220.reg (212 bytes security) (deflated 70%)
adding: backregs/A22039C0-C45C-4CAA-8DA9-88F26DF065D9.reg (212 bytes security) (deflated 76%)
adding: backregs/A9125DEE-615C-45B6-AE55-A679EC8150C4.reg (212 bytes security) (deflated 70%)
adding: backregs/B74F18C8-F252-406B-9B1B-D8B0FC279BE2.reg (212 bytes security) (deflated 70%)
adding: backregs/C4BE4370-E044-4D76-8141-D04462401B60.reg (212 bytes security) (deflated 70%)
adding: backregs/C62FD2EA-BF2C-4E13-98C1-BFB749C28DAF.reg (212 bytes security) (deflated 70%)
adding: backregs/CA9692C4-AE0E-4DC1-A1DB-2410EAF3A548.reg (212 bytes security) (deflated 70%)
adding: backregs/ED9750DD-F35F-45FC-AD31-80502AE52437.reg (212 bytes security) (deflated 70%)
adding: backregs/F432B8CF-3FE8-45CC-90E8-927B41697F12.reg (212 bytes security) (deflated 70%)
adding: backregs/FAB9C3D9-59ED-46B1-A179-B6B77BF938D0.reg (212 bytes security) (deflated 70%)
adding: backregs/FCB25DE4-58EB-4A32-95C3-C04EAC6FF99C.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 78%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Rapport Ewido :

---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------

+ Créé le: 12:32:43, 27/02/2006
+ Somme de contrôle: A247879F

+ Résultats du scan:

HKLM\SOFTWARE\Classes\CLSID\{6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKLM\SOFTWARE\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKU\S-1-5-21-1010038584-2099659216-1345631335-1008\Software\Effective-i -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKU\S-1-5-21-1010038584-2099659216-1345631335-1008\Software\Effective-i\TheSearchAccelerator -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
HKU\S-1-5-21-1010038584-2099659216-1345631335-1008\Software\Effective-i\TheSearchAccelerator\IE5 -> Adware.EffectiveBrandToolbar : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\backup.zip/dlls/EKENT.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\backup.zip/dlls/MQR.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\backup.zip/dlls/UARLBVA.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\backup.zip/dlls/UHBMON.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\dlls\EKENT.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\dlls\MQR.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\dlls\UARLBVA.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\bib\Bureau\l2mfix\dlls\UHBMON.DLL -> Adware.Look2Me : Nettoyer et sauvegarder
C:\Installer.exe -> Adware.Look2Me : Nettoyer et sauvegarder
C:\installerwebnex.exe -> Downloader.Qoologic.bh : Nettoyer et sauvegarder
C:\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Nettoyer et sauvegarder
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\INSTALL.LOG -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\IUCmore.dll -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\logo.ico -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\TBlogin.users.ucmore.com.4.5.40.0 -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\toolbar.cfg -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll -> Adware.UCmore : Nettoyer et sauvegarder
C:\Program Files\TheSearchAccelerator\UNWISE.EXE -> Adware.UCmore : Nettoyer et sauvegarder
C:\stub_113_4_0_4_0.exe -> Downloader.TSUpdate.o : Nettoyer et sauvegarder
C:\ucmoreiex.exe/UCMTSAIE.DLL -> Adware.Ucmore : Nettoyer et sauvegarder
C:\ucmoreiex.exe/IUCMORE.DLL -> Adware.Ucmore : Nettoyer et sauvegarder
C:\WINDOWS\QWRtaW4\asappsrv.dll -> Adware.CommAd : Nettoyer et sauvegarder
C:\WINDOWS\QWRtaW4\command.exe -> Adware.CommAd : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\apsueui.dll -> Downloader.Qoologic.az : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\cvvbfbj.exe -> Trojan.Pakes : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\kaqowo.exe -> Downloader.Qoologic.at : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\lmqkf.dll -> Downloader.Small : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\vgactl.cpl -> Downloader.Qoologic.at : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\vugyp.dat -> Downloader.Qoologic.at : Nettoyer et sauvegarder
C:\WINDOWS\SYSTEM32\wuauclt.dll -> Downloader.Qoologic.at : Nettoyer et sauvegarder


::Fin du rapport

Rapport HighJackThis :

Logfile of HijackThis v1.99.1
Scan saved at 12:46:57, on 27/02/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\MSSQL7\binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\windows\winsysban11.exe
C:\MSSQL7\Binn\sqlmangr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\bib\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd11.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban11.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV03.EXE
O4 - Global Startup: Gestionnaire de services SQL Server.lnk = C:\MSSQL7\Binn\sqlmangr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6523D2CB-4D3A-4DBD-B94A-ABFB6687C4AF}: Domain = mairie-meylan.lan
O17 - HKLM\System\CCS\Services\Tcpip\..\{6523D2CB-4D3A-4DBD-B94A-ABFB6687C4AF}: NameServer = 172.16.0.27,172.16.0.28
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mairie-meylan.lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mairie-meylan.lan
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWRtaW4\command.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)

Merci pour tout et désolé. Je ferai remonter mon post dès que je saurai faire.

Toujours personne pour analyser mon log et me donner le coup de main final ?
Après l2mfix, look2me-destroyer, ccleaner, easycleaner et Ewido, je ne sais plus quoi faire, moi.

Voici mon rapport HighJackThis. Le virus/trojan que je pensais avoir enfin éradiqué est revenu ce matin. On dirait qu'il se recharge lors de ma connection.
Je suis en réseau et là où je suis, les antivirus en ligne ne marchent pas. Je ne peux même pas lancer ceux qui sont installés dans ma machine.
Merci d'avance :

Logfile of HijackThis v1.99.1
Scan saved at 10:05:15, on 28/02/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\MSSQL7\binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\RealVNC\WinVNC\winvnc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\windows\winsysban11.exe
C:\MSSQL7\Binn\sqlmangr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\opsys\aloes\OpsCatFront.exe
C:\Documents and Settings\bib\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [winsysupd] c:\\winsysupd12.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban11.exe
O4 - HKLM\..\Run: [gimmygames] c:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\kaqowo.exe reg_run
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV03.EXE
O4 - Global Startup: Gestionnaire de services SQL Server.lnk = C:\MSSQL7\Binn\sqlmangr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6523D2CB-4D3A-4DBD-B94A-ABFB6687C4AF}: Domain = mairie-meylan.lan
O17 - HKLM\System\CCS\Services\Tcpip\..\{6523D2CB-4D3A-4DBD-B94A-ABFB6687C4AF}: NameServer = 172.16.0.27,172.16.0.28
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = mairie-meylan.lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = mairie-meylan.lan
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\SMLUNIRL.DLL
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWRtaW4\command.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)

Salut,

Desinstalle si existe
TheSearchAccelerator (UC more)
VCClient

1/ Redemarre en mode sans echec

2/ Lance Hijackthis ->Do a system scan only
->Coche les lignes puis Fix checked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O4 - HKLM\..\Run: [winsysupd] c:\\winsysupd12.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban11.exe
O4 - HKLM\..\Run: [gimmygames] c:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\kaqowo.exe reg_run
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe

Assure toi d'avoir acces au dossier/fichiers caches
->Panneau de configuration
->Options dossiers
->Coche Afficher les dossiers caches
Decoche Masquer les extensions...
Decoche Masquer les fichiers proteges...

3/ Suppime ces fichiers/dossiers si existe

C:\Program Files\TheSearchAccelerator
C:\winsysupd12.exe
C:\gimmygames12.exe
C:\gimmygames12.exe
C:\WINDOWS\System32\kaqowo.exe
C:\Program Files\Common Files\VCClient

Recache les fichiers/dossiers

4/ Lance un nettoyage Ccleaner
(N’oublie pas de supprimer les Erreurs (a gauche))

5/ Lance un scan Ewido Ad Aware et Spybot(mis a jour)
Colle le rapport Ewido

6/ Fais un scan en ligne Panda
Colle le rapport

7/ Reposte un log Hijackthis en mode normal

As tu encore des problemes ?

Salut,

Fix ces deux lignes :
O4 - HKLM\..\Run: [keyboard] C:\\keyboard.exe
O4 - HKLM\..\Run: [mousepad] C:\\mousepad.exe

Et installe ceci : http://www.ad-w-a-r-e.com/cgi-bin/UnInstaller pour supprimer Look 2 Me.

Telecharge pestpatrol clique ici,il l'enlevera sans probleme normalement, j'ai bien bien dit normalement...

En effet cet espiologiciel fait parti des tracking cookie
Il existe depuis janvier 2004 et sa diffusion sur le net et inferieur a 0.00005%,...
comme quoi toi tu n'as pas eut de chance (lol)
Essaye aussi ad aware et spybot (ta testé? mais je pense pas que ca va le supprimer ces 2 logiciels)
Si ca continue continue avec les rapports hijackthis...

Voila tout et bon courage!

Salut,
Essaie l'uninstaller propose en haut par Omar
Tu pour toujours faire ceci

Imprime ces instructions, ou colle les dans un fichier texte.
Regarde bien les trois indications en bas, avant de commencer la procédure.
Télécharge Look2Me-Destroyer.exe sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=7

. Ferme toutes les fenêtres actives.
. Lance l'outil Look2Me-Destroyer.exe.
. Coche Run this program as a task
. Un message s'affichera :
"Look2Me-Destroyer will close and re-open in approximately 10 seconds"-> OK
. Il se relancera après les 10 secondes, puis appuie sur le bouton Scan for L2M.
. Les icônes de ton Bureau vont disparaître.
. Le scan termine, clique sur Remove L2M
. Un nouveau message Done Scanning apparaîtra, clique sur OK.
. Suivi de Done removing infected files! Look2Me-Destroyer will now shutdown your computer -> OK.
. Ton PC va s’éteindre.
. Démarre ton PC normalement.
. Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt ,ainsi qu'un rapport HijackThis.

1/ Si Look2Me-Destroyer ne se relance pas automatiquement après les 10 secondes, redémarre et essaie à nouveau.

2/ Si tu reçois un message de ton firewall disant que l'outil tente d'accéder à l'internet : Accepte ou desactive ton firewall

3/ Si un message runtime error '339' s'affiche : télécharge MSWINSCK.OCX et place-le dans le dossier C:\Windows\System32.
http://www.ascentive.com/support/n [...] WINSCK.OCX

Ben si je coche ce que tu me dis dans HighJackThis, je ne pourrai plus faire marcher mon clavier ni ma souris, non ?

Moi ce que j'ai fait j'ai Browser mon Mozilla comme principale , ce qui a rediriger les Dll infecter vers Firefox (mozilla) et j'ai tout simplement désinstaller Firefox par la suite et laisser mon windows sans Browser principale , tout en continuant d'utiliser internet explorer , le Dll devient tout mêler !! ;-)

La prochaine fois cree ton propre topic

Imprime ces instructions, ou colle les dans un fichier texte.
Regarde bien les trois indications en bas, avant de commencer la procédure.
Télécharge Look2Me-Destroyer.exe sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=7

. Ferme toutes les fenêtres actives.
. Lance l'outil Look2Me-Destroyer.exe.
. Coche Run this program as a task
. Un message s'affichera :
"Look2Me-Destroyer will close and re-open in approximately 10 seconds"-> OK
. Il se relancera après les 10 secondes, puis appuie sur le bouton Scan for L2M.
. Les icônes de ton Bureau vont disparaître.
. Le scan termine, clique sur Remove L2M
. Un nouveau message Done Scanning apparaîtra, clique sur OK.
. Suivi de Done removing infected files! Look2Me-Destroyer will now shutdown your computer -> OK.
. Ton PC va s’éteindre.
. Démarre ton PC normalement.
. Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt ,ainsi qu'un rapport HijackThis.

1/ Si Look2Me-Destroyer ne se relance pas automatiquement après les 10 secondes, redémarre et essaie à nouveau.

2/ Si tu reçois un message de ton firewall disant que l'outil tente d'accéder à l'internet : Accepte ou desactive ton firewall

3/ Si un message runtime error '339' s'affiche : télécharge MSWINSCK.OCX et place-le dans le dossier C:\Windows\System32.
http://www.ascentive.com/support/n [...] WINSCK.OCX

merci pour l'info...
k'ai essaye et tout est reglé... ça fait du bien d'avoir un pc tout propre...
@+