Virus JS:Downloader-ARQ [Trojan]

========== PROCESSES ========== 
No active process named explorer.exe was found! 
No active process named iexplore.exe was found! 
No active process named firefox.exe was found! 
No active process named msnmsgr.exe was found! 
No active process named Teatimer.exe was found! 
========== OTL ========== 
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\HBLite@HBLite.com deleted successfully. 
File C:\Program Files (x86)\HBLite\bin\11.0.363.0\firefox\extensions not found. 
Registry value HKEY_USERS\S-1-5-19\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully. 
Registry value HKEY_USERS\S-1-5-20\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully. 
Registry value HKEY_USERS\S-1-5-21-341080539-670475263-1300986420-1004\\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully. 
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. 
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully. 
Registry value HKEY_USERS\S-1-5-21-341080539-670475263-1300986420-1001\\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully. 
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype-ie-addon-data\ deleted successfully. 
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}\ deleted successfully. 
File {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found not found. 
C:\Windows\SysNative\VCCLSID.exe moved successfully. 
C:\Windows\SysNative\SrchSTS.exe moved successfully. 
C:\Windows\SysNative\VACFix.exe moved successfully. 
C:\Windows\SysNative\IEDFix.exe moved successfully. 
C:\Windows\SysNative\IEDFix.C.exe moved successfully. 
C:\Windows\SysNative\404Fix.exe moved successfully. 
C:\Windows\SysNative\o4Patch.exe moved successfully. 
C:\Windows\SysNative\Agent.OMZ.Fix.exe moved successfully. 
C:\Windows\SysWOW64\VCCLSID.exe moved successfully. 
C:\Windows\SysWOW64\SrchSTS.exe moved successfully. 
C:\Windows\SysWOW64\VACFix.exe moved successfully. 
C:\Windows\SysWOW64\IEDFix.exe moved successfully. 
C:\Windows\SysWOW64\IEDFix.C.exe moved successfully. 
C:\Windows\SysWOW64\404Fix.exe moved successfully. 
C:\Windows\SysWOW64\o4Patch.exe moved successfully. 
C:\Windows\SysWOW64\Agent.OMZ.Fix.exe moved successfully. 
C:\Users\Mathieu\AppData\Roaming\HBLite folder moved successfully. 
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 folder moved successfully. 
========== REGISTRY ========== 
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully. 
========== FILES ========== 
File\Folder C:\Users\Mathieu\AppData\Roaming\HBLite 0 not found. 
========== COMMANDS ========== 
Restore point Set: OTL Restore Point 
  
[EMPTYTEMP] 
  
User: All Users 
  
User: Default 
->Temp folder emptied: 0 bytes 
->Temporary Internet Files folder emptied: 33170 bytes 
->Flash cache emptied: 56504 bytes 
  
User: Default User 
->Temp folder emptied: 0 bytes 
->Temporary Internet Files folder emptied: 0 bytes 
->Flash cache emptied: 0 bytes 
  
User: Mathieu 
->Temp folder emptied: 814002480 bytes 
->Temporary Internet Files folder emptied: 143213341 bytes 
->Java cache emptied: 4633 bytes 
->FireFox cache emptied: 135326809 bytes 
->Flash cache emptied: 2141 bytes 
  
User: Public 
  
User: UpdatusUser 
->Temp folder emptied: 0 bytes 
->Temporary Internet Files folder emptied: 33170 bytes 
  
%systemdrive% .tmp files removed: 0 bytes 
%systemroot% .tmp files removed: 0 bytes 
%systemroot%\System32 .tmp files removed: 0 bytes 
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes 
%systemroot%\System32\drivers .tmp files removed: 0 bytes 
Windows Temp folder emptied: 24706104 bytes 
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50674 bytes 
RecycleBin emptied: 65240 bytes 
  
Total Files Cleaned = 1 066,00 mb 
  
  
OTL by OldTimer - Version 3.2.24.1 log created on 06192011_215455 

Files\Folders moved on Reboot... 
C:\Users\Mathieu\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. 
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. 

Registry entries deleted on Reboot... 

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 22:19:30 le 19/06/2011, Mode normal

Microsoft Windows 7 Professionnel   (X64) 
Mathieu@PC-FIXE (Gigabyte Technology Co., Ltd. P35-DS3) 
 
============== ACTION(S) ==============


Dossier supprimé: C:\ProgramData\HBLiteSA
Fichier supprimé: C:\Program Files (x86)\Mozilla Firefox\plugins\npclntax_HBLiteSA.dll

(!) -- Fichiers temporaires supprimés.


Clé supprimée: HKLM\Software\Classes\CLSID\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE}
Clé supprimée: HKLM\Software\Classes\CLSID\{4E674574-3F0B-491d-8AE3-F90B43A34FD6}
Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4E674574-3F0B-491d-8AE3-F90B43A34FD6}
Clé supprimée: HKLM\Software\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}
Clé supprimée: HKLM\Software\Classes\Interface\{618AAD04-921F-44C2-BE38-C0818AF69861}
Clé supprimée: HKLM\Software\Classes\Interface\{B5D2ED96-62F9-4C2C-956D-E425B1F67337}
Clé supprimée: HKLM\Software\Classes\Interface\{D3A412E8-1E4B-47D2-9B12-F88291F5AFBB}
Clé supprimée: HKLM\Software\Classes\TypeLib\{6F098504-CDB1-420F-A2E6-DDC0B835FEDF}
Clé supprimée: HKLM\Software\Classes\HBLiteAx.Info
Clé supprimée: HKLM\Software\Classes\HBLiteAx.Info.1
Clé supprimée: HKLM\Software\Classes\HBLiteAX.UserProfiles
Clé supprimée: HKLM\Software\Classes\HBLiteAX.UserProfiles.1
Clé supprimée: HKLM\Software\HBLite
Clé supprimée: HKCU\Software\HBliteSA
Clé supprimée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [4.0.1 (fr)] ****

HKLM_MozillaPlugins\@nvidia.com/3DVision (x)
HKLM_MozillaPlugins\@nvidia.com/3DVisionStreaming (x)
Searchplugins\bing.xml (    hxxp://www.bing.com/search)
Components\browsercomps.dll (Mozilla Foundation)
Extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} (Skype extension		)

-- C:\Users\Mathieu\AppData\Roaming\Mozilla\FireFox\Profiles\fsxav71o.default --
Extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d} (Cookies Manager+)
Prefs.js - browser.startup.homepage, www.google.fr
Prefs.js - browser.startup.homepage_override.buildID, 20110413222027
Prefs.js - browser.startup.homepage_override.mstone, rv:2.0.1

========================================

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKLM_Toolbar|{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{6A7C9604-8A57-4B28-821B-BDEDF0E04788} - C:\Program Files\Microsoft Office\Office14\winproj.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
BHO\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - "avast! WebRep" (C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll)
BHO\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - "Skype Browser Helper" (C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll)
BHO\{CC59E0F9-7E43-44FA-9FAA-8377850BF205} - "FDMIECookiesBHO Class" (C:\Program Files (x86)\Free Download Manager\iefdm2.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 6 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 19/06/2011 22:20:01 (4579 Octet(s)) 

Fin à: 22:20:40, 19/06/2011 
 
============== E.O.F ============== 

Malwarebytes' Anti-Malware 1.51.0.1200  
www.malwarebytes.org  

Version de la base de données: 6897  

Windows 6.1.7600  
Internet Explorer 8.0.7600.16385  

19/06/2011 23:08:24  
mbam-log-2011-06-19 (23-08-24).txt  

Type d'examen: Examen complet (C:\|D:\|)  
Elément(s) analysé(s): 350545  
Temps écoulé: 25 minute(s), 43 seconde(s)  

Processus mémoire infecté(s): 0  
Module(s) mémoire infecté(s): 0  
Clé(s) du Registre infectée(s): 0  
Valeur(s) du Registre infectée(s): 0  
Elément(s) de données du Registre infecté(s): 0  
Dossier(s) infecté(s): 0  
Fichier(s) infecté(s): 3  

Processus mémoire infecté(s):  
(Aucun élément nuisible détecté)  

Module(s) mémoire infecté(s):  
(Aucun élément nuisible détecté)  

Clé(s) du Registre infectée(s):  
(Aucun élément nuisible détecté)  

Valeur(s) du Registre infectée(s):  
(Aucun élément nuisible détecté)  

Elément(s) de données du Registre infecté(s):  
(Aucun élément nuisible détecté)  

Dossier(s) infecté(s):  
(Aucun élément nuisible détecté)  

Fichier(s) infecté(s):  
c:\program files (x86)\ad-remover\quarantine\C\program files (x86)\mozilla firefox\plugins\npclntax_hblitesa.dll.vir (Adware.Hotbar) -> Quarantined and deleted successfully.  
c:\Users\Mathieu\downloads\VLCSetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.  
d:\dragon age 2\bin_ship\rld-da2k.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.