Virus qui reviennent sans cesse!!!

 netsvcs 
Drivers32
msconfig  
activex
/md5start  
iaStor.sys 
nvstor.sys 
atapi.sys  
iastorv.sys  
userinit.exe
winlogon.exe 
wininit.exe
explorer.exe
/md5stop
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*. 
%ALLUSERSPROFILE%\Application Data\*.exe /s
%appdata% *.exe /s 
%APPDATA%\*.  
%systemroot%\*. /mp /s 
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
CREATERESTOREPOINT 

KillAll::  

https://forums.commentcamarche.net/forum/affich-20404809-virus-qui-reviennent-sans-cesse  
Collect::[4]  
c:\documents and settings\cyril\btlop.exe
c:\documents and settings\cyril\dtlop.exe
c:\windows\Nfaqea.exe
c:\windows\1nK7SoU
c:\windows\1wTHOsiO
c:\windows\2786pE
c:\windows\2dNJsAEgM
c:\windows\4dpOWmSr4q

DirLook::
c:\documents and settings\LocalService\IETldCache  

file::
c:\windows\system32\ConduitEngine.tmp
c:\windows\wininst.exe
C:\regmem32.exe
c:\windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

DDS::
uStart Page = hxxp://www.searchqu.com/402
uInternet Settings,ProxyServer = http=127.0.0.1:8074

:OTL
IE - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/402
IE - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8074
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/402"
O4 - HKLM..\Run: [Flash Media] C:\WINDOWS\System32\  ^  %%^^    ^%^% ^% ^ ^%^   % %%%^^^%% ^%.exe File not found
O4 - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005..\Run: [bueik] C:\Documents and Settings\cyril\bueik.exe File not found
O4 - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005..\Run: [buoek] C:\Documents and Settings\cyril\buoek.exe File not found
O4 - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005..\Run: [JP595IR86O] C:\Documents and Settings\cyril\Local Settings\Temp\Ncl.exe (Windows (R) Codename Longhorn DDK provider)
O4 - HKU\S-1-5-21-1797488772-2525213324-1091034462-1005..\Run: [WHMDNR9LKK] C:\WINDOWS\Nfaqea.exe (Windows (R) Codename Longhorn DDK provider)
O4 - Startup: C:\Documents and Settings\cyril\Menu Démarrer\Programmes\Démarrage\regmem32.exe ()
O20 - Winlogon\Notify\reset5c: DllName - reset5c.dll - C:\WINDOWS\System32\reset5c.dll ()
[2011/01/03 11:52:16 | 000,124,416 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\cyril\dtlop.exe
[2011/01/04 11:10:31 | 000,077,824 | ---- | C] (UserXP) -- C:\Documents and Settings\cyril\btlop.exe
[2011/01/04 11:10:41 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011/01/04 11:10:41 | 000,000,246 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2011/01/04 11:10:40 | 000,000,282 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010/12/29 19:04:15 | 000,000,024 | ---- | M] () -- C:\Documents and Settings\cyril\Application Data\mchagw.dat
[2010/03/19 18:29:16 | 000,002,866 | ---- | C] () -- C:\Documents and Settings\cyril\Local Settings\Application Data\gykdmnhq.exe
[2010/03/09 17:24:14 | 000,000,011 | ---- | C] () -- C:\Documents and Settings\cyril\Local Settings\Application Data\sgsedpd.exe
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

:Files
c:\windows\1nK7SoU
c:\windows\1wTHOsiO
c:\windows\2786pE
c:\windows\2dNJsAEgM
c:\windows\4dpOWmSr4q
c:\windows\system32\ConduitEngine.tmp
c:\windows\wininst.exe
C:\regmem32.exe
C:\Documents and Settings\cyril\Local Settings\Temp\kyjrhkbts\

:Commands
[EMPTYTEMP]
[EMPTYFLASH]