ADWARE/BProtector.E

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1bead0acfa0c574db939e074563abb98
# engine=16147
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-06 08:53:06
# local_time=2013-12-06 09:53:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 89260 156991291 82028 0
# compatibility_mode=5893 16776574 100 94 12661573 137949836 0 0
# scanned=542160
# found=23
# cleaned=0
# scan_time=69477
sh=49DCDF79F0F6889BB8FD954C2D2A436FBA587C67 ft=1 fh=92d17993b61af695 vn="Win32/Adware.Yontoo application" ac=I fn="C:\FRST\Quarantine\FreeTwitTube-S-Setup_Suite1.exe"
sh=49DCDF79F0F6889BB8FD954C2D2A436FBA587C67 ft=1 fh=92d17993b61af695 vn="Win32/Adware.Yontoo application" ac=I fn="C:\Nero Autobackup\20131204_232147_Local Autobackup\C\FRST\Quarantine\FreeTwitTube-S-Setup_Suite1.exe"
sh=49DCDF79F0F6889BB8FD954C2D2A436FBA587C67 ft=1 fh=92d17993b61af695 vn="Win32/Adware.Yontoo application" ac=I fn="C:\Nero Autobackup\20131205_112149_Local Autobackup\C\FRST\Quarantine\FreeTwitTube-S-Setup_Suite1.exe"
sh=49DCDF79F0F6889BB8FD954C2D2A436FBA587C67 ft=1 fh=92d17993b61af695 vn="Win32/Adware.Yontoo application" ac=I fn="C:\Nero Autobackup\20131205_132147_Local Autobackup\C\FRST\Quarantine\FreeTwitTube-S-Setup_Suite1.exe"
sh=8D4B302C02A0EF8A6FA8F1FBF00D6E10F12A606E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.ONV trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache1627041106020210408.tmp"
sh=3F3DB09E44DC32A87184626BE5E1B09806238FF3 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.AH trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache1797777441270655203.tmp"
sh=EAC65B594738CABAADFBEBA7A3AEA1BCF1308600 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2011-3544.DD trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache2298354301265461031.tmp"
sh=14D99443D1E190D63F1D4B3499C87C0A987CD19F ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.ONV trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache236072571738333543.tmp"
sh=FE40451F5CD8E684725C554F0B188476BA3E0AA7 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.ONV trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache2627906752019535932.tmp"
sh=FE40451F5CD8E684725C554F0B188476BA3E0AA7 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.ONV trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache304396394748981210.tmp"
sh=DFC57922038BFC73B7EE41C4AA4246392D0D5EB4 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.AH trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache3594422079976759851.tmp"
sh=8D4B302C02A0EF8A6FA8F1FBF00D6E10F12A606E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.ONV trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache3923560336935460513.tmp"
sh=547036485CCFAA4E1A57AC096FD57FD75C1CECD1 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.AH trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache4117558440753956861.tmp"
sh=EAC65B594738CABAADFBEBA7A3AEA1BCF1308600 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2011-3544.DD trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache4142314864708106993.tmp"
sh=5B34B45B382805CDFF05581D16133C5E4052058E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2011-3544.DD trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache4722351850853325369.tmp"
sh=3F3DB09E44DC32A87184626BE5E1B09806238FF3 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.AH trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache7586765593566810732.tmp"
sh=5B34B45B382805CDFF05581D16133C5E4052058E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2011-3544.DD trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache7798254182737564144.tmp"
sh=DFC57922038BFC73B7EE41C4AA4246392D0D5EB4 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-0507.AH trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache9007652116103058340.tmp"
sh=34AF8EC37F8C199385551E160D2DB452FD6CA970 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2011-3544.DD trojan" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\jar_cache9138352419396115579.tmp"
sh=CBFFBFEFBBA13C3D477844F705D414EB27179D5A ft=0 fh=0000000000000000 vn="Win32/Adware.Yontoo application" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\YontooFFClient.xpi"
sh=CF172E67B8ECEA347BAA76FF9DC5FE97C04547C6 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\YontooLayers.crx"
sh=AF6978F4185769EEB2798D0CF841A12E1FB8FCB9 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.B application" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\YontooLayers\background.html"
sh=62FBCF95CD127605D0A99AB0C55A5FF883603825 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.A application" ac=I fn="C:\Users\Jasskas\AppData\Local\Temp\YontooLayers\yl.js"