(virus-ver)bloque ma session+chantage!

bonsoir
je demande votre aide car je suis carrement dans les choux ...

voila ce qui m'arrive:

kaspersky m'a trouvé un virus worm au cours d'un scan il y a 2 jours :
"Im-worm win32.kelvir.bp" a la fin du scan il l'a detruit .
jusque la ça va ..
je redemare le pc et apres l'ouverture de ma session(en meme temps que ce charge mon bureau) il apparait une "fenetre"prenant tout l'ecran et me bloquant carrement toute action sur le pc !!
(je suis en mode sans echec avec prise en charge du reseau pour pouvoir vous expliquer ..)
cette fenetre est agrementé de 2 gifs assez explicite ... d'un texte que je vous met plus bas faisant du chantage au paiement et d'une case pour pouvoir mettre le "code "de debloquage qui sera envoyé suite a un paiement par western union !
voici le texte:



"Listen up muthafucka, is this computer valuable, is better not be. Is this a Bussiness computer, is better not be. Do you keep imoortant company records or files in this computer, you´d better hope not, because therea are files scattered all over it tucked away in invisible hidden folders undetectable by antivirus software, the only way to remove them and this message is by a CIDN: number.
This X.aip will load every time tha you starts windows scattering more and more copies of itself until your computer is fried to a pulp. Until then you may even notice others programs missing critical files.

How to remove it? Sample. You must receive a CIDN: Number from western union.
Go to Western Union, fill out the grey form labeled SwiftPay, pay $10.99 as your costumer acces number enter "4 8 7 0 9 3 0 1 0 1 3 0 8 6 9 7" you name sign any name i.e. John Doe and waiting for a receipt from the clerk. Look on the top righ-hand corner of the receipt for a number that starts with CIDN: i.e. CIDN: 203-093-1903 come back to this computer and enter your CIDN number. The unnistall process will begin.

Note: If you don´t pay exactly $10.99 you will generate an invalid CIDN number and be forced to start over"

HERE THERE IS A SUBMIT WINDOW FOR TO SET A CIDN NUMBER

"If you have a valid CIDN number and have problems uninstalling send a request to unlock3713@yahoo.com I will research the problem and if applicable send a alternate CIDN Universal key by email.




et il est impossible de faire quoi que ce soit sur la session !
SI , a part ctrl-alt-sup et la je vois bien les fichiers qui se mettent en route :
data001.exe,jusqu'a data009.exe
001.exe jusqu'a 009.exe
virus.tmp (4 fois)tourne dans la barre des taches
dans le gestionnaire des taches :en faisant ctrl-alt-sup sur les "exe"et effacer , ils reviennent aussi tot ! ils se regenerent !!

les datas reaparraissent au demarage de windows et toujours dans le dossier Windows .j'ai beau les effacés quand je suis en mode sans echec ils reviennent au redemarage.
en faisant un clic droit sur une des 2 images de la page j'ai pu voir "web.exe" mais introuvable sur le hd.

j'ai quand meme batailler dur depuis deux jours pour enlever cette m.... :
apres avoir supprimé pas mal de fichiers avec les differents prog qui suivent:
kaspersky : ok
spykiller :ok
tune up utility 2006 :ok en m'aidant de "registry editor"pour trouver les cles et les supprimer (en vain)
ad-aware :ok
ewido :ok
spybot :ok
mru blaster :ok
clean up :ok
et hi jackthis : dont je me sert pour la premiere fois et toujours en mode sans echec . le probleme apparait il quand meme ?
voici le startup list:

StartupList report, 31/12/2005, 01:25:28
StartupList version: 1.52.2
Started from : C:\Documents and Settings\rugue13\Bureau\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\rugue13\Bureau\HijackThis.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
KAVPersonal50 = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
(Default) =
CloneCDTray = "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
VirtualCloneDrive = "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

cleanup = C:\WINDOWS\system32\oobe\setup\corpstats.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
pdfSaver3 = "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Maintenance en 1 clic.job

--------------------------------------------------

Enumerating Download Program Files:

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

[Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\chelloInstall.dll
CODEBASE = http://quickfix2.chello.fr/quickfix2/asp/chelloInstall.CAB

[Minesweeper Flags Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\minesweeper.dll
CODEBASE = http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\messengerstatsclient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

[ZoneIntro Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Zintro.ocx
CODEBASE = http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

[clsDefault Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\LaunchApp.dll
CODEBASE = http://quickfix2.chello.fr/quickfix2/asp/LaunchApp.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Hotmail Attachments Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\HMAtchmt.ocx
CODEBASE = http://by103fd.bay103.hotmail.msn.com/activex/HMAtchmt.ocx

[Solitaire Showdown Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\solitaireshowdown.dll
CODEBASE = http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 5 667 bytes
Report generated in 0,000 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only



merci pour votre aide et Bonne Année a vous tous :-)