Vbs malware-gen détécté avec grâce à AVAST

salut

▶ Téléchargez UsbFix (créé par El Desaparecido) sur votre Bureau.

▶ Si votre antivirus affiche une alerte, ignorez-la et désactivez l'antivirus temporairement.
▶ Branchez toutes vos sources de données externes à votre PC (clé USB, disque dur externe, etc...) sans les ouvrir.
▶ Double cliquez sur UsbFix.exe. (pour les utilisateurs de windows Vista , windows 7 , windows 8 , clique droit => executer en tant qu'administrateur"

▶ Cliquez sur [Suppression].
▶ Laissez travailler l'outil.

▶ À la fin du scan, un rapport va s'afficher, postez-le dans votre prochaine réponse sur le forum.

▶ Le rapport est aussi sauvegardé à la racine du disque système ( C:\UsbFix.txt ).

Rapport :

############################## | UsbFix V 7.129 | [Suppression]

Utilisateur: Administrateur (Administrateur) # SWEET-1096F42DF
Mis à jour le 24/06/2013 par El Desaparecido
Lancé à 13:06:35 | 20/07/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload-malware-pour-analyse-t489.html
Contact: contact@sosvirus.net

PC: AWARD_ (AWRDACPI) (X86-based PC)
CPU: Intel(R) Pentium(R) 4 CPU 3.20GHz (3200)
RAM -> [Total : 1503 | Free : 376]
BIOS: Phoenix - AwardBIOS v6.00PG
BOOT: Normal boot

OS: Microsoft Windows XP Professionnel (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 37 Go (21 Go libre(s) - 56%) [] # NTFS
D:\ -> Disque fixe # 37 Go (36 Go libre(s) - 98%) [] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
H:\ -> Disque fixe # 466 Go (451 Go libre(s) - 97%) [TOSHIBA EXT] # NTFS

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [SoundMan] - SOUNDMAN.EXE
HKLM\SOFTWARE | Run : [SiSPower] - Rundll32.exe SiSPower.dll,ModeAgent
HKLM\SOFTWARE | Run : [NeroFilterCheck] - C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
HKLM\SOFTWARE | Run : [SecurDisc] - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
HKLM\SOFTWARE | Run : [InCD] - C:\Program Files\Nero\Nero 7\InCD\InCD.exe
HKLM\SOFTWARE | Run : [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [ZoneAlarm Client] - "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-21-1123561945-299502267-1177238915-500\SOFTWARE | Run : [LightScribe Control Panel] - C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
HKU\S-1-5-21-1123561945-299502267-1177238915-500\SOFTWARE | Run : [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
HKU\S-1-5-21-1123561945-299502267-1177238915-500\SOFTWARE | Run : [OfficeSyncProcess] - "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
HKU\S-1-5-21-1123561945-299502267-1177238915-500\SOFTWARE | Run : [Facebook Update] - "C:\Documents and Settings\Administrateur\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-1123561945-299502267-1177238915-500\SOFTWARE | Run : [Software updater] - "C:\Documents and Settings\Administrateur\Application Data\FreeSoftwareUpdater\updater.exe" -h http://neoupdater.com/
HKU\S-1-5-20\SOFTWARE | RunOnce : [JkDefrag] - rundll32 advpack.dll,LaunchINFSection JKDEFRAG.INF,RunOnce,1,N
HKU\S-1-5-20\SOFTWARE | RunOnce : [SweetRegistry] - rundll32 advpack.dll,LaunchINFSection SweetReg.inf,PerUserStub
HKU\S-1-5-18\SOFTWARE | RunOnce : [JkDefrag] - rundll32 advpack.dll,LaunchINFSection JKDEFRAG.INF,RunOnce,1,N
HKU\S-1-5-18\SOFTWARE | RunOnce : [SweetRegistry] - rundll32 advpack.dll,LaunchINFSection SweetReg.inf,PerUserStub

################## | Processus Stoppés |

Stoppé! C:\WINDOWS\system32\ZoneLabs\vsmon.exe (732)
Stoppé! C:\WINDOWS\Explorer.exe (464)
Stoppé! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (192)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (580)
Stoppé! C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (1184)
Stoppé! C:\Program Files\Google\Update\GoogleUpdate.exe (1292)
Stoppé! C:\Program Files\Java\jre7\bin\jqs.exe (300)
Stoppé! C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (512)
Stoppé! C:\Program Files\Nero\Nero 7\InCD\InCD.exe (368)
Stoppé! C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (1024)
Stoppé! C:\WINDOWS\system32\srvany.exe (1100)
Stoppé! C:\WINDOWS\KMService.exe (1324)
Stoppé! C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe (1300)
Stoppé! C:\Program Files\AVAST Software\Avast\avastUI.exe (1264)
Stoppé! C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (188)
Stoppé! C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe (532)
Stoppé! C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (1652)
Stoppé! C:\Documents and Settings\Administrateur\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe (1072)
Stoppé! C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (964)
Stoppé! C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe (2248)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (1048)

################## | Éléments infectieux |

Supprimé! D:\winrar-393fr-01net.exe
Supprimé! D:\autorun.inf
Supprimé! H:\autorun.inf
Supprimé! H:\R

(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableSR

################## | Mountpoints2 |

################## | Listing |

[17/07/2013 - 19:00:01 | N | 5545] C:\AdwCleaner[S1].txt
[17/06/2013 - 23:37:05 | D ] C:\AHCache
[08/05/2013 - 12:40:47 | N | 0] C:\AUTOEXEC.BAT
[08/05/2013 - 12:34:02 | N | 212] C:\boot.ini
[14/04/2008 - 14:00:00 | N | 4952] C:\Bootfont.bin
[23/09/2008 - 06:01:14 | | 1364] C:\changelog_MassStorage.txt
[19/07/2013 - 17:32:27 | D ] C:\Config.Msi
[08/05/2013 - 12:40:47 | N | 0] C:\CONFIG.SYS
[08/05/2013 - 14:25:04 | D ] C:\D
[08/04/2008 - 12:46:45 | N | 55808] C:\devcon.exe
[17/06/2013 - 23:53:46 | D ] C:\Documents and Settings
[02/05/2008 - 11:11:10 | N | 364721] C:\DPsFnshr.exe
[27/09/2008 - 18:25:49 | N | 630] C:\DPSFNSHR.INI
[07/04/2007 - 20:52:09 | N | 420] C:\DriverPack_CPU_wnt5_x86-32.ini
[11/04/2008 - 21:33:25 | N | 1279] C:\DriverPack_Graphics_A_wnt5_x86-32.ini
[29/12/2007 - 21:38:08 | N | 1653] C:\DriverPack_Graphics_B_wnt5_x86-32.ini
[23/12/2007 - 12:04:03 | N | 1822] C:\DriverPack_Graphics_C_wnt5_x86-32.ini
[14/05/2008 - 07:02:31 | N | 770] C:\DriverPack_LAN_wnt5_x86-32.ini
[23/09/2008 - 06:01:08 | | 84942] C:\DriverPack_MassStorage_wnt5_x86-32.ini
[01/04/2008 - 17:37:53 | N | 4214] C:\DriverPack_Sound_A_wnt5_x86-32.ini
[12/04/2008 - 11:47:12 | | 3525] C:\DriverPack_Sound_B_wnt5_x86-32.ini
[02/05/2008 - 11:11:14 | N | 282725] C:\DSPdsblr.exe
[08/05/2013 - 12:40:47 | N | 0] C:\IO.SYS
[10/05/2013 - 22:54:31 | D ] C:\Log
[08/04/2008 - 12:46:45 | N | 20992] C:\makePNF.exe
[08/05/2013 - 12:40:47 | N | 0] C:\MSDOS.SYS
[08/05/2013 - 12:49:37 | RHD ] C:\MSOCache
[08/04/2008 - 12:46:45 | N | 137728] C:\mute.exe
[14/04/2008 - 14:00:00 | N | 47564] C:\NTDETECT.COM
[14/04/2008 - 14:00:00 | N | 252240] C:\ntldr
[20/07/2013 - 11:38:32 | ASH | 754974720] C:\pagefile.sys
[17/07/2013 - 19:11:34 | N | 512] C:\PhysicalMBR.bin
[02/05/2008 - 11:11:17 | N | 235131] C:\pmtimer.exe
[17/07/2013 - 18:59:42 | RD ] C:\Program Files
[08/05/2013 - 13:26:18 | SHD ] C:\RECYCLER
[17/07/2013 - 19:11:24 | SHD ] C:\System Volume Information
[20/07/2013 - 13:08:02 | D ] C:\UsbFix
[20/07/2013 - 13:08:34 | A | 7208] C:\UsbFix [Clean 1] SWEET-1096F42DF.txt
[20/07/2013 - 01:16:08 | D ] C:\WINDOWS
[17/07/2013 - 03:00:51 | D ] D:\0c39c4e19d1da2d790120c9c5c
[08/05/2013 - 13:15:11 | D ] D:\Office_Pro_Plus_2010_32bits_Fr
[08/05/2013 - 13:26:38 | SHD ] D:\RECYCLER
[08/05/2013 - 12:45:34 | SHD ] D:\System Volume Information
[17/05/2013 - 20:58:58 | N | 47730] H:\ UNIT 01.doc
[17/05/2013 - 20:53:44 | N | 28785] H:\ .doc
[17/05/2013 - 21:05:41 | N | 168057] H:\ _1.doc
[03/01/2011 - 20:28:44 | N | 136] H:\.picasa.ini
[17/05/2013 - 18:48:05 | D ] H:\1.Adeh
[17/05/2013 - 18:48:01 | D ] H:\100
[21/01/2011 - 16:03:50 | N | 115988] H:\5- ??? ?????????? ?? ??????? ??????.pdf
[17/07/2013 - 03:34:02 | D ] H:\7juillet
[26/01/2012 - 00:28:09 | N | 156610] H:\ara.docx
[17/05/2013 - 20:58:59 | N | 466928] H:\Ass.doc
[17/05/2013 - 20:58:57 | N | 439932] H:\Asm.doc
[17/05/2013 - 20:53:44 | N | 570973] H:\Asvg.doc
[05/05/2013 - 17:37:16 | N | 409537] H:\Dc3.pdf
[05/05/2013 - 17:37:19 | N | 409537] H:\Dc4.pdf
[17/07/2013 - 16:59:07 | D ] H:\defb15eb27defd0366ec91f6bdc7b4
[17/05/2013 - 20:53:44 | N | 31353] H:\De.doc
[18/04/2013 - 21:46:56 | N | 321464] H:\doc.pdfaze.pdf
[19/07/2013 - 13:14:40 | D ] H:\ed7690d032a785464c008f710113
[17/05/2013 - 20:48:10 | N | 638792] H:\Euro Currency Tools.xls
[25/02/2013 - 16:17:44 | N | 169767] H:\Ex3.pdf
[07/10/2012 - 21:08:23 | N | 2883555] H:\ex.pdf
[08/07/2013 - 13:12:34 | D ] H:\ggg
[01/12/2012 - 22:30:05 | N | 821760] H:\is.doc
[17/05/2013 - 21:11:28 | N | 73834] H:\Lettre.doc
[03/07/2013 - 01:27:46 | D ] H:\musique
[21/02/2007 - 19:53:30 | N | 189121] H:\NeroDigitalPluginAdobePremiere_Eng.pdf
[22/03/2007 - 16:38:08 | N | 202990] H:\NeroDigitalPluginAdobePremiere_Fra.pdf
[30/05/2013 - 20:56:57 | D ] H:\Nouveau dossier
[04/06/2013 - 14:24:21 | D ] H:\Nouveau dossier (2)
[17/05/2013 - 12:45:18 | D ] H:\Nouveau dossier (3)
[30/06/2013 - 21:39:34 | D ] H:\Nouveau dossier (4)
[06/07/2013 - 19:23:10 | D ] H:\Nouveau dossier (5)
[22/06/2013 - 15:14:58 | D ] H:\Nouveau dossier (6)
[22/06/2013 - 15:12:35 | D ] H:\Nouveau dossier (7)
[26/05/2013 - 21:28:32 | D ] H:\Nouveau dossier (8)
[25/12/2011 - 18:52:02 | N | 897536] H:\AA.xls
[17/05/2013 - 20:48:09 | N | 139378] H:\PowerPoint Presentation.ppt
[17/05/2013 - 20:48:09 | N | 62976] H:\PowerPoint Presentation_1.ppt
[17/05/2013 - 20:48:09 | N | 65138] H:\PowerPoint Presentation_2.ppt
[17/05/2013 - 20:51:43 | N | 167936] H:\PowerPoint Presentation_3.ppt
[17/05/2013 - 21:11:28 | N | 103090] H:\PowerPoint Presentation_4.ppt
[17/05/2013 - 21:12:11 | N | 74701] H:\PowerPoint Presentation_5.ppt
[17/05/2013 - 14:30:38 | SHD ] H:\RECYCLER
[17/05/2013 - 14:47:29 | D ] H:\récup
[17/07/2013 - 03:29:15 | D ] H:\DD
[19/06/2013 - 15:03:06 | D ] H:\sc
[30/05/2013 - 20:56:38 | D ] H:\Nd
[16/01/2010 - 04:03:40 | N | 1303823] H:\k1er.pdf
[03/10/2009 - 12:15:38 | N | 6590225] H:\k2.pdf
[23/11/2012 - 03:37:02 | N | 1976252] H:\Sc123.zip
[15/02/2012 - 14:50:20 | N | 16415068] H:\Software Offer.exe
[17/05/2013 - 12:29:53 | SHD ] H:\System Volume Information
[19/06/2013 - 14:54:34 | D ] H:\ww
[17/05/2013 - 20:48:09 | N | 54934150] H:\[000309].pdf
[17/05/2013 - 20:48:09 | N | 47750] H:\[000348].pdf
[17/05/2013 - 20:47:38 | N | 46038022] H:\[000350].pdf
[17/05/2013 - 20:46:25 | N | 957005] H:\[000650].pptx
[17/05/2013 - 20:46:26 | N | 303149] H:\[000722].pdf
[17/05/2013 - 20:47:10 | N | 69020915] H:\[000839].pdf
[17/05/2013 - 20:51:19 | N | 58481] H:\[000849].doc
[17/05/2013 - 20:48:53 | N | 72110258] H:\[001093].pdf
[17/05/2013 - 20:46:25 | N | 40336] H:\[001420].pdf
[17/05/2013 - 20:51:43 | N | 112498] H:\[001498].pdf
[17/05/2013 - 20:48:53 | N | 52857] H:\[001733].doc
[17/05/2013 - 20:48:53 | N | 39849] H:\[001742].pdf
[17/05/2013 - 20:48:53 | N | 37397] H:\[001748].pdf
[17/05/2013 - 20:51:43 | N | 234318] H:\[001975].pdf
[17/05/2013 - 20:51:20 | N | 32881] H:\[002035].doc
[17/05/2013 - 20:46:25 | N | 51734] H:\[002057].pdf
[17/05/2013 - 20:51:42 | N | 24062969] H:\[002097].pdf
[17/05/2013 - 20:51:42 | N | 208896] H:\[002151].doc
[17/05/2013 - 20:51:42 | N | 428634] H:\[002169].pdf
[17/05/2013 - 20:51:16 | N | 221525952] H:\[002223].pdf
[17/05/2013 - 20:51:19 | N | 2829038] H:\[002385].pdf
[17/05/2013 - 20:51:19 | N | 425918] H:\[002389].pdf
[17/05/2013 - 20:53:44 | N | 187645597] H:\[002476].pdf
[17/05/2013 - 20:53:44 | N | 40605] H:\[003375].pdf
[17/05/2013 - 20:58:58 | N | 108763] H:\[003521].pdf
[17/05/2013 - 20:46:24 | N | 616056] H:\[003587].pdf
[17/05/2013 - 20:53:44 | N | 321566] H:\[003658].pdf
[17/05/2013 - 20:59:41 | N | 56474127] H:\[003678].pdf
[17/05/2013 - 20:59:03 | N | 51727] H:\[003722].pdf
[17/05/2013 - 20:53:45 | N | 30321] H:\[003807].doc
[17/05/2013 - 20:58:58 | N | 1475847] H:\[003948].pdf
[17/05/2013 - 20:58:56 | N | 255508257] H:\[004027].pdf
[17/05/2013 - 21:13:09 | N | 85270305] H:\[004087].pdf
[17/05/2013 - 20:56:25 | N | 85266209] H:\[004088].pdf
[17/05/2013 - 21:12:07 | N | 44944813] H:\[004119].pdf
[17/05/2013 - 21:12:11 | N | 5299629] H:\[004147].pdf
[17/05/2013 - 20:58:59 | N | 269102] H:\[004190].pdf
[17/05/2013 - 21:12:11 | N | 194550] H:\[004218].pdf
[17/05/2013 - 20:53:44 | N | 147456] H:\[004222].doc
[17/05/2013 - 20:58:57 | N | 1525675] H:\[004267].pdf
[17/05/2013 - 20:46:25 | N | 235570] H:\[004276].pdf
[17/05/2013 - 20:55:34 | N | 190451050] H:\[004302].pdf
[17/05/2013 - 20:55:34 | N | 55409] H:\[004309].doc
[17/05/2013 - 20:55:34 | N | 105834] H:\[004364].pdf
[17/05/2013 - 20:59:02 | N | 2034221] H:\[004490].pdf
[17/05/2013 - 20:59:01 | N | 964169] H:\[004491].pdf
[17/05/2013 - 20:59:03 | N | 964169] H:\[004503].pdf
[17/05/2013 - 20:59:00 | N | 2034221] H:\[004504].pdf
[17/05/2013 - 20:59:41 | N | 15507] H:\[006900].docx
[17/05/2013 - 20:59:41 | N | 15507] H:\[009603].docx
[17/05/2013 - 21:05:40 | N | 59537] H:\[010008].docx
[17/05/2013 - 21:05:19 | N | 164917] H:\[010130].pdf
[17/05/2013 - 21:05:19 | N | 118688] H:\[010132].pdf
[17/05/2013 - 21:05:40 | N | 32231662] H:\[010153].pdf
[17/05/2013 - 21:05:41 | N | 53550] H:\[010238].pdf
[17/05/2013 - 21:05:18 | N | 585624178] H:\[010443].pdf
[17/05/2013 - 21:11:28 | N | 489236505] H:\[010532].pdf
[17/05/2013 - 21:05:41 | N | 849945] H:\[010623].pdf
[17/05/2013 - 20:48:09 | N | 137258] H:\ÇáÍÓÇÈÇÊ ÇáßíãíÇÆíÉ.doc
[17/05/2013 - 20:53:44 | N | 96910] H:\ÏÇÑÉ ßåÑÈÇÆíÉ ÊÊßæä Úáì ÇáÊÓáÓá ãä æÔíÚÉ æäÇÞá Ãæãí ãÞÇæãÊå æãæáÏ ÞæÊå ÇáãÍÑßÉ ÇáßåÑÈÇÆíÉ æÞÇØÚÉ ßãÇ Ýí ÇáÔßá ( 1 )¡ äÛáÞ ÇáÞÇØÚÉ ÚäÏ .doc
[17/05/2013 - 20:46:26 | N | 53369] H:\اÙ"جÙ...Ù#Ù^رÙSØ© اÙ"جزائرÙSØ© اÙ"دÙSÙ...Ù^Ù'راطÙSØ© اÙ"Ø'عبÙSØ©.doc
[17/05/2013 - 20:51:20 | N | 52345] H:\اÙ"جÙ...Ù#Ù^رÙSÙ`Ø© اÙ"جزائرÙSÙ`Ø© اÙ"دÙSÙ...Ù'راطÙSÙ`Ø© اÙ"Ø'عبÙSÙ`Ø©.doc
[17/05/2013 - 20:55:34 | N | 47225] H:\اÙ"جÙ...Ù#Ù^رÙSÙ`Ø© اÙ"جزائرÙSÙ`Ø© اÙ"دÙSÙ...Ù'راطÙSÙ`Ø© اÙ"Ø'عبÙSÙ`Ø©_1.doc
[17/05/2013 - 20:51:20 | N | 52337] H:\خصائص اÙ"أدب Ù ÙS عصر اÙ"ضع٠_ - Ø¥Ù+ Ù#ذا اÙ"عصر عÙ"Ù0/00 Ø·Ù^Ù"Ù# ÙfاÙ+ اضع٠عصÙ^ر اÙ"أدب اÙ"عربÙS Ù^تسÙ"Ø· Ù ÙSÙ# اÙ"Ø®Ù...Ù^Ù" عÙ"Ù0/00 اÙ"عÙ'Ù^Ù"Ù^اÙ"تÙ'Ù"ÙSد عÙ"Ù0/00 اÙ"ابتÙfار Ù^اÙ"صÙ+عة اÙ"Ù"Ù .doc
[04/11/2012 - 15:16:32 | N | 658037] H:\??????? ??? 6.pdf

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
H:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

cette version de windows n'est pas légale

& que devrais-je faire pour supprimer ce virus ?

commencer par avoir une version légale t'aurais moins de problèmes