Ständiger wiederkehrender Maleware Fund "Trojan.Win32.Vague.cg" in C:\Windows\Temp\41560_updater.exe

XML-Interpretation fehlgeschlagen

XML-Interpretation fehlgeschlagen: Syntaxfehler (Zeile: 53, Zeichen: 307)

Dokument als HTML neu analysieren.
Fehler:
illegal byte sequence in encoding 
Spezifikation:
hxxp://www.w3.org/TR/REC-xml/#charencoding 
 50: <key><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30F9B915-B755-4826-820B-08FBA6BD249D}</path><vendor>PUP.Optional.ConduitTB.A</vendor><action>success</action><hash>e4ee76de116aa591aee570bb5ca6a15f</hash></key>
 51: <key><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BA14329E-9550-4989-B3F2-9732E92D17CC}</path><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><hash>9a385004adced06686d953d98c762ad6</hash></key>
 52: <key><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BA14329E-9550-4989-B3F2-9732E92D17CC}</path><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><hash>9a385004adced06686d953d98c762ad6</hash></key>
 53: <value><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{BA14329E-9550-4989-B3F2-9732E92D17CC}</valuename><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><valuedata>�2\14�P��I��2�-\17�</valuedata><hash>9a385004adced06686d953d98c762ad6</hash></value>
 54: <value><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS</path><valuename>{BA14329E-9550-4989-B3F2-9732E92D17CC}</valuename><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><valuedata></valuedata><hash>9a385004adced06686d953d98c762ad6</hash></value>
 55: <value><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{BA14329E-9550-4989-B3F2-9732E92D17CC}</path><valuename></valuename><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><valuedata></valuedata><hash>2aa864f073083ff7b5aabc70ac563fc1</hash></value>
 56: <value><path>HKU\S-1-5-21-3344588163-4229223017-3211320431-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{ba14329e-9550-4989-b3f2-9732e92d17cc}</path><valuename></valuename><vendor>PUP.Optional.VuzeRemoteTB.A</vendor><action>success</action><valuedata></valuedata><hash>844e69eb7506dc5aadb2ad7f20e24cb4</hash></value>
         

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e74326d206a8c4448a05dc5eef323098
# engine=18381
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-23 06:32:38
# local_time=2014-05-23 08:32:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 71 76 176327 196370 0 0
# compatibility_mode=5893 16776573 100 94 78865 152499808 0 0
# scanned=2049380
# found=23
# cleaned=0
# scan_time=23008
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=359D977D432E4F90FE627B2717144AE873990AC4 ft=1 fh=63c7b0ee3e7f229d vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\DVDVideoSoftTB.exe.vir"
sh=CE3BEB48AE65E3F396DEE5F9313451E50D05B16E ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\WebCakeBHO13.zip"
sh=028B7C4E9B087D5015187BF8613D8B01784E562B ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\WebCakeBHO18.zip"
sh=2DB7A8F19C78C61D04EECA30749BC115F0441340 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\WebCakeBHO3.zip"
sh=4BDB04F37B4AC593B9609325E5A1599DFABFD5F1 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\WebCakeBHO8.zip"
sh=CE3BEB48AE65E3F396DEE5F9313451E50D05B16E ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\WebCakeBHO13.zip"
sh=028B7C4E9B087D5015187BF8613D8B01784E562B ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\WebCakeBHO18.zip"
sh=2DB7A8F19C78C61D04EECA30749BC115F0441340 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\WebCakeBHO3.zip"
sh=4BDB04F37B4AC593B9609325E5A1599DFABFD5F1 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\WebCakeBHO8.zip"
sh=1E00782FEC3CA539AE30F866502633FF550356C6 ft=1 fh=46da0b21d76c5220 vn="Variante von Win32/Toolbar.Conduit.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sascha AD\AppData\LocalLow\ZoneAlarm-Sicherheit\ldrtbZone.dll"
sh=E6F9792E271F52A2245CC8D72C05A57D6DFBBDE3 ft=1 fh=0690a81bbbd9c1b6 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Sascha AD\AppData\LocalLow\ZoneAlarm-Sicherheit\tbZone.dll"
sh=2B6EF659892076DB5A636E32BE3B5F79024F3A2D ft=1 fh=aec8a87bf89146d8 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\zaSetupWeb_110_780_000.exe"
sh=DF71A27F15A939B32CCD116396203865321EA997 ft=1 fh=f745e44a930aa54b vn="Variante von Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\ag_mp3_plugin_setup.exe"
sh=70B69721791D7F6685581F5A28167D8CD6572008 ft=1 fh=8a8ff7b6904af9d5 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\FreeVideoToMp3Converter35.exe"
sh=E8CD33623287C08C7CC3662A042E45522654BB30 ft=1 fh=7cd3b160b0dbd4bd vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\FreeYouTubeToMP3Converter.exe"
sh=CDF78456BC8BF322B7FB4E4FBED3DDDDA59F8508 ft=1 fh=03a040e36938398e vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zafwSetupWeb_102_057_000.exe"
sh=F79CD7689C98BABCDA2C3B6DF3CFBCC6D562A45D ft=1 fh=705b84b19b7250d3 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zafwSetupWeb_102_064_000.exe"
sh=5CE7620607515E33C2860911C9E89BC8C9ADC2C6 ft=1 fh=94417141fe3284df vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zafwSetupWeb_102_068_000.exe"
sh=238B76E136A032D4601301E567760EC10C814124 ft=1 fh=f14483085eb0dc09 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zafwSetupWeb_110_000_038.exe"
sh=56B73A78C28AF357F18FC9CB1402B5EB9359E6DB ft=1 fh=16883c458a85e77c vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zaSetupWeb_101_065_000.exe"
sh=C94F3CA125B5FFDD02308BB81B766987350A3BC3 ft=1 fh=78fc5d575345147c vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\zaSetupWeb_101_079_000.exe"
sh=B25DFC38B84D9E21F4ECE88E942AAF3CC22EAB8E ft=1 fh=cda1cbd4b2e6ebee vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\Treiber + Updates\Installiert\FreeYouTubeToMP333Converter.exe"