Windows 7 fährt im abgesicherten Modus gleich wieder runter. GUV Trojaner vermutet

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-09-2014
Ran by Admin at 2014-09-25 16:02:13 Run:3
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin & UpdatusUser (Available profiles: Admin & UpdatusUser & Sven Assmus & Jasmin Assmus)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
SearchScopes: HKLM - {4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {39A529EC-E4EC-4855-8580-CFF500731638} URL = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A7941509802&ie=UTF-8&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A7941509802&q={searchTerms}
SearchScopes: HKCU - {4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKCU - {FF481B6B-BC63-42aa-8526-B73519970194} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
C:\Users\Jasmin Assmus\AppData\Roaming\Splashtop
C:\ProgramData\Splashtop
C:\Users\Admin\AppData\Roaming\Splashtop
C:\Program Files (x86)\Splashtop
EmptyTemp:
end

*****************

Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02}" => Key deleted successfully.
"HKCR\CLSID\{4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{39A529EC-E4EC-4855-8580-CFF500731638}" => Key deleted successfully.
"HKCR\CLSID\{39A529EC-E4EC-4855-8580-CFF500731638}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02}" => Key deleted successfully.
"HKCR\CLSID\{4BD293F1-8E15-4ABA-B9CB-BAFF37FDEE02}" => Key not found.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FF481B6B-BC63-42aa-8526-B73519970194}" => Key deleted successfully.
"HKCR\CLSID\{FF481B6B-BC63-42aa-8526-B73519970194}" => Key not found.
C:\Users\Jasmin Assmus\AppData\Roaming\Splashtop => Moved successfully.
C:\ProgramData\Splashtop => Moved successfully.
C:\Users\Admin\AppData\Roaming\Splashtop => Moved successfully.
C:\Program Files (x86)\Splashtop => Moved successfully.
EmptyTemp: => Removed 376.4 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=fe349a103a7ea043b8a6e8caf35908e1
# engine=20298
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-09-25 03:24:17
# local_time=2014-09-25 05:24:17 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 83719 163288507 0 0
# scanned=122178
# found=28
# cleaned=0
# scan_time=4523
sh=12B30F06DE4B38484E58A004543758EA9F65F36A ft=1 fh=781357805484811d vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\LPT\sppsm.dll.vir"
sh=C696420672CC9583EE25234BC40103134DEE216D ft=1 fh=52d20409e583a93c vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\LPT\spusm.dll.vir"
sh=B37C9A6AF89E4F0FB618B9B240238E59BAF618BD ft=1 fh=79eafbea18d82a4d vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\LPT\srbu.dll.vir"
sh=CE152C474456A556DA72FF11046823390BB51F01 ft=1 fh=ff20f9951bba5771 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Local\LPT\srptc.dll.vir"
sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Admin\AppData\Roaming\OpenCandy\2378071C8050403FA40F3B0C1EE90C60\sp-downloader.exe.vir"
sh=CE152C474456A556DA72FF11046823390BB51F01 ft=1 fh=ff20f9951bba5771 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files (x86)\LPT\srptc.dll"
sh=9C6C68EFAE364FC17008C32848E148F86D468C99 ft=1 fh=c71c0011e4b098f3 vn="Variante von Win32/ELEX.AM evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe"
sh=4DE76870B5DD198AF2383211CE89B16F557A01C2 ft=1 fh=213484538c339776 vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll"
sh=CFB134DC5B3D59D91432CCC830108D24E65411DF ft=1 fh=325523c45a4e101c vn="Variante von MSIL/Toolbar.Linkury.E evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll"
sh=EF647452606582CE0F881B17F0615E034C4B9875 ft=1 fh=2e134036b71ca7db vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll"
sh=DF602B96F4BDA04EA9352C926DCB8F078363E434 ft=1 fh=b1f6dc399231e851 vn="Variante von MSIL/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll"
sh=739CA8DC9E2E55936778AC68C9E509ACD91C8598 ft=1 fh=16a98f21b81a3037 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\spbl.dll"
sh=2CB199FEC232033540D08747F20F82E472174DA4 ft=1 fh=7246b04e5129a9e1 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\sppsm.dll"
sh=5FAF467F8E399C07CB2D70F32DA35A728EF39848 ft=1 fh=f10771e2b66702d4 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\spusm.dll"
sh=0743EB9C6E585FB817668E30B03474AABF0919C4 ft=1 fh=0f5e6bb2c675d399 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\srbu.dll"
sh=0C9E08A7209E62284CC9E7B254EE448ADFDB226F ft=1 fh=09b8805e90a427e5 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll"
sh=544294BE63286E65343AEB0C635691AED83EC6FE ft=1 fh=2c20a82a657c453e vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll"
sh=7490AEEF60C67035A17073C7E22948D780998B0E ft=1 fh=6af4360a4bb034a6 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll"
sh=26082D5DB9B347F437494C4C653142E9955602C3 ft=1 fh=703cca51fc20c81a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll"
sh=9F0960865FDEF1980F6819E256EEB3D3B7D02509 ft=1 fh=7244fccad6277424 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll"
sh=0D3F379B123A44B84640F39DEC0EF089AD09118C ft=1 fh=f95a2dc466a76cfe vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_30.dll"
sh=6B8689ED74F52CF66DA70B37BAEB6774F3BD20A8 ft=1 fh=dc5c298251a2ce0b vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_31.dll"
sh=9432F0B83856109CE9FB238A2F1625209D2E65AB ft=1 fh=1fe9360e40e47706 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\Admin\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_32.dll"
sh=5EAD5075399AB2C0276FADCDECA1977CFCB4356E ft=1 fh=903a244665eefe94 vn="Variante von Win64/Riskware.NetFilter.F Anwendung" ac=I fn="C:\FRST\Quarantine\C\Windows\System32\drivers\{00c97d86-accb-4288-9972-6d929c1fe93a}w64.sys.xBAD"
sh=D8B9AB0CF742A8377770E548FCD5FA6731393C61 ft=1 fh=5d418a319aee4e1f vn="Variante von Win64/Riskware.NetFilter.F Anwendung" ac=I fn="C:\FRST\Quarantine\C\Windows\System32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}w64.sys.xBAD"
sh=F112BC68E12A24A2EDA7A58F1AEE1229B3F13DE4 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\Sicherung alte Platte\WinZip Professional 15 v15.5.9510 Final - dArKwOLf\WINZIP15.5.9510 SETUP\winzip155.msi"
sh=41B2F82B7815B67D4FC03B2D019493FB3C81AE47 ft=1 fh=f70fea66709298cb vn="Variante von Win32/InstallCore.MZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sven Assmus\Desktop\itunes_setup.exe"
sh=924FBFDFE9B60F15B52812AA6E122D15C5640F50 ft=0 fh=0000000000000000 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\6adfde.msi"
         

 Results of screen317's Security Check version 0.99.87  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````