| |
| |||||||
Anleitungen, FAQs & Links: Sweet-page.com Browser Hijacker entfernenWindows 7 Hilfreiche Anleitungen um Trojaner zu entfernen. Viele FAQs & Links zum Thema Sicherheit, Malware und Viren. Die Schritt für Schritt Anleitungen zum Trojaner entfernen sind auch für nicht versierte Benutzer leicht durchführbar. Bei Problemen, einfach im Trojaner-Board nachfragen - unsere Experten helfen kostenlos. Weitere Anleitungen zu Hardware, Trojaner und Malware sind hier zu finden. |
25.02.2014, 18:25
| #1 |
| Administrator |  Sweet-page.com Browser Hijacker entfernen Sweet-page.com Browser Hijacker entfernen Was ist Sweet-page.com Browser Hijacker? Sweet-page.com Browser Hijacker ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Sweet-page.com Browser Hijacker) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden. Da solche Software wie Sweet-page.com Browser Hijacker sich gegen jede Entfernung wehren wird und Sweet-page.com Browser Hijacker oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden. Verbreitet wird Scareware wie Sweet-page.com Browser Hijacker nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html). Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!   Symptome von Sweet-page.com Browser Hijacker:
Fake-Meldungen von Sweet-page.com Browser Hijacker: Dateien von Sweet-page.com Browser Hijacker: Code:
ATTFilter %AppData%SupTab
%AppData%SupTabSupTab.dll
%AppData%sweet-page
%AppData%sweet-page40.json
%AppData%sweet-pageuninstallDlg.xml
%AppData%sweet-pageUninstallManager.exe
%AppData%sweet-pageimages
%AppData%sweet-pageimagesbg1.png
%AppData%sweet-pageimagesbutton1.png
%AppData%sweet-pageimageschecked.png
%AppData%sweet-pageimagesclose.png
%AppData%sweet-pageimagesmin.png
%AppData%sweet-pageimagesThumbs.db
%AppData%sweet-pageimagesunchecked.png%CommonAppData%IePluginService
%CommonAppData%IePluginServicePluginService.exe
%CommonAppData%IePluginServiceupdate
%CommonAppData%IePluginServiceupdateconf
%CommonAppData%WPM
%CommonAppData%WPMwprotectmanager.exe
%CommonAppData%WPMupdate
%CommonAppData%WPMupdateconf
c:Program FilesMozilla Firefoxsearchpluginssweet-page.xml
c:Program FilesSupTab
c:Program FilesSupTabBHOEnabler.exe
c:Program FilesSupTabinstall.data
c:Program FilesSupTabSupIePluginServiceUpdate.exe
c:Program FilesSupTabSupTab.dll
c:Program FilesSupTabuninstall.exe
c:Program FilesSupTabweb
c:Program FilesSupTabwebindexIE.html
c:Program FilesSupTabwebindexIE8.html
c:Program FilesSupTabwebstyle.css
c:Program FilesSupTabwebver.txt
c:Program FilesSupTabweb_locales
c:Program FilesSupTabweb_localesen-US
c:Program FilesSupTabweb_localesen-USmessages.json
c:Program FilesSupTabweb_localeses-419
c:Program FilesSupTabwebimg
c:Program FilesSupTabwebimgdefault_logo.png
c:Program FilesSupTabwebimgicon128.png
c:Program FilesSupTabwebimgicon16.png
c:Program FilesSupTabwebimgicon48.png
c:Program FilesSupTabwebimgloading.gif
c:Program FilesSupTabwebimgweather
c:Program FilesSupTabwebimgweather.png
c:Program FilesSupTabwebimgweather1.png
c:Program FilesSupTabwebjs
c:Program FilesSupTabwebjsbackground.js
c:Program FilesSupTabwebjsga.js
c:Program FilesSupTabwebjsjquery.autocomplete.js
c:Program FilesSupTabwebjsjquery-base.js
c:Program FilesSupTabwebjsjs.js
c:Program FilesSupTabwebjsxagainit.js
File Location Notes:%CommonAppData% refers to the Application Data folder for the All Users Profile. By default, this is C:Documents and SettingsAll UsersApplication Data for Windows 2000/XP and C:ProgramData in Windows Vista, Windows 7, and Windows 8.%AppData% refers to the current users Application Data folder. By default, this is C:Documents and Settings<Current User>Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:Users<Current User>AppDataRoaming.%CommonAppData% refers to the Application Data folder in the All Users profile. For Windows XP, Vista, NT, 2000 and 2003 it refers to C:Documents and SettingsAll UsersApplication Data, and for Windows Vista, Windows 7, and Windows 8 it is C:ProgramData.
Registry-Einträge von Sweet-page.com Browser Hijacker: Code:
ATTFilter HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}
HKEY_CLASSES_ROOTCLSID{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
HKEY_CLASSES_ROOTInterface{917CAAE9-DD47-4025-936E-1414F07DF5B8}
HKEY_CLASSES_ROOTTypeLib{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallIePlugins
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallSupTab
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallsweet-page uninstaller
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallWPM
HKEY_LOCAL_MACHINESOFTWAREsupTab
HKEY_LOCAL_MACHINESOFTWAREsupWPM
HKEY_LOCAL_MACHINESOFTWAREsweet-pageSoftware
HKEY_LOCAL_MACHINESOFTWAREWpm
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWpm
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Default_Page_URL" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerTabbedBrowsing "NewTabPageShow" = "0"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "C:Program FilesMozilla Firefoxfirefox.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetGoogle Chromeshellopencommand "(Default)" = "C:Documents and SettingsBleepingLocal SettingsApplication DataGoogleChromeApplicationchrome.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "C:Program FilesInternet Exploreriexplore.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetOperashellopencommand "(Default)" = "C:Program FilesOperaOpera.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetOpera.exeshellopencommand "(Default)" = "C:Program FilesOperaOpera.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetSafari.exeshellopencommand "(Default)" = "C:Program FilesSafariSafari.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetSEAMONKEY.EXEshellopencommand "(Default)" = "C:Program FilesSeaMonkeyseamonkey.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Default_Page_URL" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Default_Search_URL" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Search Page" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Start Page" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch "CustomizeSearch" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"
HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch "SearchAssistant" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"
Sweet-page.com Browser Hijacker im HijackThis-Log: Code:
ATTFilter R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:Program FilesSupTabSupTab.dll
O23 - Service: IePlugin Service (IePluginService) - Cherished Technololgy LIMITED - %CommonAppData%IePluginServicePluginService.exe
O23 - Service: Wpm Service (Wpm) - Cherished Technololgy LIMITED - %CommonAppData%WPMwprotectmanager.exe
|
Baum-Darstellung