Ituneshelper.vbe

Hello,
I have also the problem of Ituneshelper.vbe virus, I just done the scan using the program.

My report is:

############################## | UsbFix V 7.153 | [Deletion]

User: user (Administrator) # USER-4AEEF16D51
Updated 09/12/2013 by El Desaparecido - Team SosVirus
Started at 12:57:05 | 10/12/2013

Website : http://www.en.usbfix.net
Forum : https://www.sosvirus.net/
Upload Malware : http://www.sosvirus.net/upload_malware.php
Contact : http://www.en.usbfix.net/contact/

PC: Apple Inc. (Mac-F22587C8)
CPU: Processore Intel Pentium III Xeon
RAM -> [Total : 2791 | Free : 1640]
Bios: Apple Inc.
Boot: Normal boot

OS: Microsoft Windows XP Professional (5.1.2600 32-Bit) Service Pack 3
WB: Windows Internet Explorer : 8.0.6001.18702
WB: Google Chrome : 24.0.1312.57

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 122 Gb (10 Mb free - 8%) [BOOTCAMP] # NTFS
D:\ -> Removable drive # 7 Gb (3 Mb free - 44%) [YANJUN] # FAT32
E:\ -> CD-ROM
G:\ -> Fixed drive # 176 Gb (4 Mb free - 2%) [Macintosh HD] # HFS

################## | Stopped processes |

Stopped! C:\WINDOWS\system32\nvsvc32.exe (ID: 1212 |ParentID: 1024)
Stopped! C:\Programmi\360\360sd\360rps.exe (ID: 1428 |ParentID: 1024)
Stopped! C:\Programmi\360\360safe\deepscan\zhudongfangyu.exe (ID: 1676 |ParentID: 1024)
Stopped! C:\WINDOWS\system32\spoolsv.exe (ID: 1944 |ParentID: 1024)
Stopped! C:\WINDOWS\system32\WgaTray.exe (ID: 160 |ParentID: 976)
Stopped! C:\WINDOWS\Explorer.EXE (ID: 180 |ParentID: 2032)
Stopped! C:\WINDOWS\system32\ctfmon.exe (ID: 168 |ParentID: 180)
Stopped! C:\WINDOWS\system32\RUNDLL32.EXE (ID: 628 |ParentID: 180)
Stopped! C:\WINDOWS\system32\rundll32.exe (ID: 648 |ParentID: 180)
Stopped! C:\Programmi\Boot Camp\Bootcamp.exe (ID: 652 |ParentID: 180)
Stopped! C:\Programmi\360\360safe\safemon\360Tray.exe (ID: 668 |ParentID: 180)
Stopped! C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (ID: 676 |ParentID: 180)
Stopped! C:\Program Files\SogouMobileTool\SogouMobileToolHelper.exe (ID: 700 |ParentID: 180)
Stopped! C:\WINDOWS\system32\wscript.exe (ID: 688 |ParentID: 180)
Stopped! C:\Programmi\360\360sd\360sd.exe (ID: 272 |ParentID: 180)
Stopped! C:\Documents and Settings\user\Impostazioni locali\Dati applicazioni\Akamai\netsession_win.exe (ID: 588 |ParentID: 180)
Stopped! C:\Programmi\Autodesk\Autodesk Sync\AdSync.exe (ID: 1460 |ParentID: 180)
Stopped! C:\Documents and Settings\user\Impostazioni locali\Dati applicazioni\Akamai\netsession_win.exe (ID: 420 |ParentID: 588)
Stopped! C:\Programmi\Microsoft Office\Office12\ONENOTEM.EXE (ID: 352 |ParentID: 180)
Stopped! C:\Programmi\360\360safe\SoftMgr\SML\SoftMgrLite.exe (ID: 2016 |ParentID: 668)
Stopped! C:\WINDOWS\system32\AppleOSSMgr.exe (ID: 2164 |ParentID: 1024)
Stopped! C:\WINDOWS\system32\AppleTimeSrv.exe (ID: 2196 |ParentID: 1024)
Stopped! C:\Programmi\Autodesk\Content Service\Connect.Service.ContentService.exe (ID: 2240 |ParentID: 1024)
Stopped! C:\Programmi\Bonjour\mDNSResponder.exe (ID: 2396 |ParentID: 1024)
Stopped! C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (ID: 2476 |ParentID: 1024)
Stopped! C:\SIMULIA\Documentation\monitor.exe (ID: 2716 |ParentID: 1024)
Stopped! C:\Programmi\360\360sd\360rp.exe (ID: 2824 |ParentID: 1428)
Stopped! C:\SIMULIA\Documentation\monitor.exe (ID: 3020 |ParentID: 2716)
Stopped! C:\WINDOWS\system32\wuauclt.exe (ID: 3456 |ParentID: 1356)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [NvCplDaemon] - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
04 - HKLM\SOFTWARE | Run : [NvMediaCenter] - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
04 - HKLM\SOFTWARE | Run : [nwiz] - nwiz.exe /installquiet
04 - HKLM\SOFTWARE | Run : [BluetoothAuthenticationAgent] - rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
04 - HKLM\SOFTWARE | Run : [Apple_KbdMgr] - C:\Programmi\Boot Camp\Bootcamp.exe
04 - HKLM\SOFTWARE | Run : [360Safetray] - "C:\Programmi\360\360safe\safemon\360Tray.exe" /start
04 - HKLM\SOFTWARE | Run : [Acrobat Assistant 8.0] - "C:\Programmi\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
04 - HKLM\SOFTWARE | Run : [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k
04 - HKLM\SOFTWARE | Run : [] -
04 - HKLM\SOFTWARE | Run : [SogouMobileTool] - C:\Program Files\SogouMobileTool\SogouMobileToolHelper.exe
04 - HKLM\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\DOCUME~1\user\IMPOST~1\Temp\iTunesHelper.vbe"
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKU\S-1-5-19\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-20\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\ctfmon.exe
04 - HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\SOFTWARE | Run : [360sd] - "C:\Programmi\360\360sd\360sd.exe" /autorun
04 - HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\SOFTWARE | Run : [Akamai NetSession Interface] - "C:\Documents and Settings\user\Impostazioni locali\Dati applicazioni\Akamai\netsession_win.exe"
04 - HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\SOFTWARE | Run : [Autodesk Sync] - C:\Programmi\Autodesk\Autodesk Sync\AdSync.exe
04 - HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\SOFTWARE | Run : [iTunesHelper] - wscript.exe //B "C:\DOCUME~1\user\IMPOST~1\Temp\iTunesHelper.vbe"
04 - HKU\S-1-5-18\SOFTWARE | Run : [CTFMON.EXE] - C:\WINDOWS\system32\CTFMON.EXE
04 - HKU\S-1-5-18\SOFTWARE | Run : [Autodesk Sync] - C:\Programmi\Autodesk\Autodesk Sync\AdSync.exe

################## | Generic Research |

Deleted ! C:\DOCUME~1\user\IMPOST~1\Temp\iTunesHelper.vbe
Deleted ! C:\Documents and Settings\user\Menu Avvio\Programmi\Esecuzione automatica\iTunesHelper.vbe
Deleted ! D:\iTunesHelper.vbe
Deleted ! D:\.fseventsd.lnk
Deleted ! D:\Nuova cartella.lnk
Deleted ! D:\Plan B.lnk
Deleted ! D:\Attachments_20131119.lnk
Deleted ! D:\Plan A.lnk
Deleted ! D:\rev projet avance.lnk
Deleted ! D:\SYLLABUS TECHNOLOGIE DES CONSTRUCTIONS EN BOIS - CHAP10.lnk
Deleted ! D:\2013-11-04-masterplan-PLAN00.lnk
Deleted ! D:\2013-11-07-PLAN01-03-1.lnk
Deleted ! D:\cadastre-LayoutA4.lnk
Deleted ! D:\TESI.lnk
Deleted ! D:\.lnk
Deleted ! D:\.Trashes.lnk
Deleted ! D:\.Spotlight-V100.lnk
Deleted ! D:\pdf.lnk
Deleted ! D:\Urba 2.lnk
Deleted ! D:\RyanairBoardingPass.lnk
Deleted ! D:\1995-1-1_novembre 2004_italiano.lnk
Deleted ! D:\2013-11-20-masterplan.lnk
Deleted ! D:\Labo3.lnk
Deleted ! D:\cadastre-LayoutA0.lnk
Deleted ! D:\cadastre-LayoutA3.lnk
Deleted ! D:\MATLAB SCRIPT.lnk
Deleted ! D:\MATLAB INSTALL FILE.lnk
Deleted ! D:\couese slides of FEM.lnk
Deleted ! D:\System Volume Information.lnk
Deleted ! D:\pathologie tp.lnk
Deleted ! D:\TP.lnk
Deleted ! D:\REV 6.lnk
Deleted ! C:\RECYCLER\S-1-5-21-1202660629-1284227242-1801674531-1003
Deleted ! C:\RECYCLER\S-1-5-21-1202660629-1284227242-1801674531-500

(!) Temporary files deleted.

################## | Reference of comparison MD5 |

Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Documents and Settings\user\Menu Avvio\Programmi\Esecuzione automatica\iTunesHelper.vbe
Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\DOCUME~1\user\IMPOST~1\Temp\iTunesHelper.vbe
Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> D:\iTunesHelper.vbe

################## | Comparison MD5 |

Deleted ! Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Documents and Settings\Administrator\Impostazioni locali\Temp\iTunesHelper.vbe
Deleted ! Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Documents and Settings\Administrator\Menu Avvio\Programmi\Esecuzione automatica\iTunesHelper.vbe

################## | Registry |

Deleted ! HKLM\Software\iTunesHelper
Not deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|360Safetray
Deleted ! HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper
Deleted ! HKU\S-1-5-21-1202660629-1284227242-1801674531-1003\Software\.\.\.\.\Mountpoints2\D

################## | Listing |

[25/05/2013 - 15:31:48 | N | 0 Ko] - C:\ADR_ColdStart.txt
[10/12/2013 - 12:46:03 | N | 7 Ko] - C:\UsbFix [Clean 1] USER-4AEEF16D51.txt
[10/12/2013 - 13:17:27 | A | 8 Ko] - C:\UsbFix [Clean 2] USER-4AEEF16D51.txt
[11/12/2012 - 13:48:43 | N | 0 Ko] - C:\IO.SYS
[11/12/2012 - 13:48:43 | N | 0 Ko] - C:\MSDOS.SYS
[11/12/2012 - 13:48:43 | N | 0 Ko] - C:\CONFIG.SYS
[10/12/2013 - 12:55:46 | ASH | 2095104 Ko] - C:\pagefile.sys
[11/12/2012 - 14:06:02 | N | 2 Ko] - C:\RHDSetup.log
[11/12/2012 - 13:27:50 | SH | 0 Ko] - C:\boot.ini
[14/04/2008 - 13:00:00 | N | 46 Ko | B2DE3452DE03674C6CEC68B8C8CE7C78] - C:\NTDETECT.COM
[14/04/2008 - 13:00:00 | N | 5 Ko] - C:\Bootfont.bin
[11/12/2012 - 13:48:43 | A | 0 Ko] - C:\AUTOEXEC.BAT
[14/04/2008 - 13:00:00 | RASH | 246 Ko] - C:\ntldr
[16/01/2010 - 08:48:12 | D] - C:\Dev-Cpp
[07/12/2010 - 19:16:34 | D] - C:\KNAUF
[11/12/2012 - 14:00:05 | SHD] - C:\System Volume Information
[11/12/2012 - 14:05:21 | D] - C:\Intel
[14/01/2013 - 15:48:54 | D] - C:\360SANDBOX
[14/01/2013 - 21:01:09 | D] - C:\KuGouCache
[25/01/2013 - 10:12:03 | D] - C:\42171afe161d784d7040cb
[04/02/2013 - 18:48:06 | D] - C:\¿áÆÁ×ÊÔ'
[07/02/2013 - 18:42:06 | D] - C:\8eb94cfc020e4f09e6b0f224c21ecc
[02/04/2013 - 15:57:37 | RHD] - C:\MSOCache
[08/04/2013 - 15:03:15 | D] - C:\_AcroTemp
[11/05/2013 - 10:00:26 | D] - C:\ppsfile
[13/10/2013 - 15:54:27 | D] - C:\Documents and Settings
[13/10/2013 - 16:50:25 | D] - C:\Autodesk
[13/10/2013 - 17:03:29 | D] - C:\360Downloads
[06/11/2013 - 21:33:00 | D] - C:\360Rec
[16/11/2013 - 00:28:21 | D] - C:\Programmi
[16/11/2013 - 00:28:31 | D] - C:\SIMULIA
[16/11/2013 - 18:39:05 | D] - C:\WINDOWS
[05/12/2013 - 20:46:36 | D] - C:\Program Files
[05/12/2013 - 22:05:59 | D] - C:\Temp
[10/12/2013 - 08:17:38 | D] - C:\$360Section
[10/12/2013 - 13:16:53 | D] - C:\UsbFix
[10/12/2013 - 13:16:57 | SHD] - C:\RECYCLER
[17/10/2013 - 18:43:42 | SHD] - D:\.Trashes
[17/10/2013 - 18:43:42 | N | 4 Ko] - D:\._.Trashes
[17/10/2013 - 18:43:42 | D] - D:\.Spotlight-V100
[11/09/2013 - 08:15:58 | N | 37285 Ko] - D:\Urba 2.pdf
[26/10/2013 - 13:32:18 | N | 174 Ko] - D:\RyanairBoardingPass.pdf
[26/10/2013 - 13:35:10 | N | 4 Ko] - D:\._RyanairBoardingPass.pdf
[04/11/2013 - 16:31:02 | N | 2191 Ko] - D:\cadastre-LayoutA0.pdf
[04/11/2013 - 16:38:04 | N | 1491 Ko] - D:\cadastre-LayoutA4.pdf
[04/11/2013 - 16:39:02 | N | 1767 Ko] - D:\cadastre-LayoutA3.pdf
[07/11/2013 - 05:18:50 | N | 309 Ko] - D:\2013-11-07-PLAN01-03-1.100-COLORE.pdf
[07/11/2013 - 07:34:26 | N | 222 Ko] - D:\2013-11-04-masterplan-PLAN00.pdf
[19/11/2013 - 23:01:34 | N | 2720 Ko] - D:\1995-1-1_novembre 2004_italiano.pdf
[19/11/2013 - 23:23:14 | N | 4 Ko] - D:\._Urba 2.pdf
[20/11/2013 - 10:20:38 | N | 8991 Ko] - D:\SYLLABUS TECHNOLOGIE DES CONSTRUCTIONS EN BOIS - CHAP10.pdf
[21/11/2013 - 13:10:42 | N | 3919 Ko] - D:\2013-11-20-masterplan.dwg
[21/11/2013 - 17:40:02 | N | 227 Ko] - D:\Labo3.docx
[21/11/2013 - 22:27:28 | N | 4 Ko] - D:\._Labo3.docx
[20/11/2013 - 09:50:04 | N | 4 Ko] - D:\._Attachments_20131119
[06/03/2013 - 15:02:30 | D] - D:\MATLAB SCRIPT
[06/03/2013 - 15:02:30 | D] - D:\couese slides of FEM
[01/11/2013 - 12:54:56 | D] - D:\Plan A
[01/11/2013 - 12:55:00 | D] - D:\Plan B
[04/11/2013 - 11:37:38 | D] - D:\rev projet avance
[04/11/2013 - 16:36:40 | SHD] - D:\System Volume Information
[08/11/2013 - 18:03:44 | D] - D:\TP
[10/11/2013 - 16:47:48 | D] - D:\MATLAB INSTALL FILE
[14/11/2013 - 04:56:30 | D] - D:\REV 6
[18/11/2013 - 23:28:32 | D] - D:\TESI
[20/11/2013 - 09:50:04 | D] - D:\Attachments_20131119
[26/11/2013 - 00:02:18 | D] - D:\doc ??
[26/11/2013 - 00:03:08 | D] - D:\pathologie tp
[28/11/2013 - 12:16:46 | D] - D:\pdf
[26/05/2011 - 14:37:56 | ND] - G:\.vol
[11/12/2012 - 09:18:40 | ND] - G:\.Trashes
[31/08/2009 - 11:25:26 | N | 0 Ko] - G:\.com.apple.timemachine.supported
[10/12/2012 - 17:48:11 | ND] - G:\.Spotlight-V100
[11/07/2013 - 14:52:02 | N | 0 Ko] - G:\libpeerconnection.log
[26/05/2011 - 15:02:50 | N | 4 Ko] - G:\.journal_info_block
[26/05/2011 - 15:02:50 | N | 24576 Ko] - G:\.journal
[09/12/2013 - 22:33:27 | ND] - G:\.fseventsd
[23/06/2009 - 07:19:52 | N | 0 Ko] - G:\.file
[05/12/2012 - 10:59:59 | N | 16 Ko] - G:\.DS_Store (dal vecchio Mac)
[01/04/2013 - 16:06:17 | N | 16 Ko] - G:\.DS_Store
[10/12/2012 - 17:51:14 | N | 0 Ko] - G:\.com.apple.timemachine.donotpresent (dal vecchio Mac)
[31/08/2009 - 13:37:59 | N | 0 Ko] - G:\.com.apple.timemachine.donotpresent
[09/12/2013 - 13:07:47 | N | 0 Ko] - G:\.dbfseventsd
[10/08/2013 - 22:28:31 | N | 256 Ko] - G:\.hotfiles.btree
[23/06/2009 - 07:19:46 | ND] - G:\Network
[23/06/2009 - 07:19:46 | ND] - G:\dev
[03/09/2009 - 11:54:20 | ND] - G:\private
[03/09/2009 - 12:00:17 | ND] - G:\net
[03/09/2009 - 12:00:17 | ND] - G:\home
[24/09/2009 - 19:55:14 | ND] - G:\home (dal vecchio Mac)
[26/05/2011 - 14:45:45 | N | 4 Ko] - G:\etc
[26/05/2011 - 15:01:00 | N | 4 Ko] - G:\tmp
[26/05/2011 - 15:02:49 | N | 4 Ko] - G:\var
[08/06/2011 - 00:35:53 | N | 20344 Ko] - G:\mach_kernel
[10/12/2012 - 18:46:08 | ND] - G:\usr
[10/12/2012 - 19:01:54 | ND] - G:\Library
[11/12/2012 - 09:48:49 | ND] - G:\System
[01/04/2013 - 16:47:03 | ND] - G:\Users
[12/10/2013 - 19:25:44 | ND] - G:\bin
[12/10/2013 - 19:25:46 | ND] - G:\sbin
[19/11/2013 - 19:13:23 | ND] - G:\Applications
[09/12/2013 - 22:33:09 | ND] - G:\Volumes

################## | Vaccin |

D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F | http://www.usbfix.net - https://www.sosvirus.net/ |