Trojaner-Board - Sweet-page.com Browser Hijacker entfernen

Sweet-page.com Browser Hijacker entfernen

Was ist Sweet-page.com Browser Hijacker?
Sweet-page.com Browser Hijacker ist eine weitere Rogue-Malware in Form einer gefälschten Scan-Software, die mittels eines sog. Trojaners in den PC eindringt und dem Benutzer weissmacht, den PC nach Malware abzusuchen. Diese Software (Sweet-page.com Browser Hijacker) ist ein Fake und selbst eine Schadsoftware und sollte nicht gekauft werden.

Da solche Software wie Sweet-page.com Browser Hijacker sich gegen jede Entfernung wehren wird und Sweet-page.com Browser Hijacker oftmals noch Rootkits mitinstalliert, sollte eine Neuinstallation des Systems in Erwägung gezogen werden.

Verbreitet wird Scareware wie Sweet-page.com Browser Hijacker nicht mehr ausschliesslich über 'dubiose Seiten' für Cracks, KeyGens und Warez, sondern auch seriöse Seiten werden zunehmend für die Verbreitung dieser mißbraucht (http://www.trojaner-board.de/90880-d...tallation.html).

Der wichtigste Schutz vor einer Infizierung ist ein aktuelles Windows (mit allen Updates) und aktuelle Drittanbietersoftware wie Java oder Adobe Flash!

http://img.trojaner-board.de/sweet-p...hijacker/1.jpg http://img.trojaner-board.de/sweet-p...hijacker/2.jpg

Symptome von Sweet-page.com Browser Hijacker:

ständige Fake Virenmeldungen von Sweet-page.com Browser Hijacker
PC läuft seit Sweet-page.com Browser Hijacker langsamer als üblich

Fake-Meldungen von Sweet-page.com Browser Hijacker:

Dateien von Sweet-page.com Browser Hijacker:

Code:

%AppData%SupTab

%AppData%SupTabSupTab.dll

%AppData%sweet-page

%AppData%sweet-page40.json

%AppData%sweet-pageuninstallDlg.xml

%AppData%sweet-pageUninstallManager.exe

%AppData%sweet-pageimages

%AppData%sweet-pageimagesbg1.png

%AppData%sweet-pageimagesbutton1.png

%AppData%sweet-pageimageschecked.png

%AppData%sweet-pageimagesclose.png

%AppData%sweet-pageimagesmin.png

%AppData%sweet-pageimagesThumbs.db

%AppData%sweet-pageimagesunchecked.png%CommonAppData%IePluginService

%CommonAppData%IePluginServicePluginService.exe

%CommonAppData%IePluginServiceupdate

%CommonAppData%IePluginServiceupdateconf

%CommonAppData%WPM

%CommonAppData%WPMwprotectmanager.exe

%CommonAppData%WPMupdate

%CommonAppData%WPMupdateconf

c:Program FilesMozilla Firefoxsearchpluginssweet-page.xml

c:Program FilesSupTab

c:Program FilesSupTabBHOEnabler.exe

c:Program FilesSupTabinstall.data

c:Program FilesSupTabSupIePluginServiceUpdate.exe

c:Program FilesSupTabSupTab.dll

c:Program FilesSupTabuninstall.exe

c:Program FilesSupTabweb

c:Program FilesSupTabwebindexIE.html

c:Program FilesSupTabwebindexIE8.html

c:Program FilesSupTabwebstyle.css

c:Program FilesSupTabwebver.txt

c:Program FilesSupTabweb_locales

c:Program FilesSupTabweb_localesen-US

c:Program FilesSupTabweb_localesen-USmessages.json

c:Program FilesSupTabweb_localeses-419

c:Program FilesSupTabwebimg

c:Program FilesSupTabwebimgdefault_logo.png

c:Program FilesSupTabwebimgicon128.png

c:Program FilesSupTabwebimgicon16.png

c:Program FilesSupTabwebimgicon48.png

c:Program FilesSupTabwebimgloading.gif

c:Program FilesSupTabwebimgweather

c:Program FilesSupTabwebimgweather.png

c:Program FilesSupTabwebimgweather1.png

c:Program FilesSupTabwebjs

c:Program FilesSupTabwebjsbackground.js

c:Program FilesSupTabwebjsga.js

c:Program FilesSupTabwebjsjquery.autocomplete.js

c:Program FilesSupTabwebjsjquery-base.js

c:Program FilesSupTabwebjsjs.js

c:Program FilesSupTabwebjsxagainit.js

        

File Location Notes:%CommonAppData% refers to the Application Data folder for the All Users Profile. By default, this is C:Documents and SettingsAll UsersApplication Data for Windows 2000/XP and C:ProgramData in Windows Vista, Windows 7, and Windows 8.%AppData% refers to the current users Application Data folder.  By default, this is C:Documents and Settings<Current User>Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:Users<Current User>AppDataRoaming.%CommonAppData% refers to the Application Data folder in the All Users profile.  For Windows XP, Vista, NT, 2000 and 2003 it refers to C:Documents and SettingsAll UsersApplication Data, and for Windows Vista, Windows 7, and Windows 8 it is C:ProgramData.

Registry-Einträge von Sweet-page.com Browser Hijacker:

Code:

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerSearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}

HKEY_CLASSES_ROOTCLSID{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

HKEY_CLASSES_ROOTInterface{917CAAE9-DD47-4025-936E-1414F07DF5B8}

HKEY_CLASSES_ROOTTypeLib{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallIePlugins

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallSupTab

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallsweet-page uninstaller

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallWPM

HKEY_LOCAL_MACHINESOFTWAREsupTab

HKEY_LOCAL_MACHINESOFTWAREsupWPM

HKEY_LOCAL_MACHINESOFTWAREsweet-pageSoftware

HKEY_LOCAL_MACHINESOFTWAREWpm

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWpm

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain "Default_Page_URL" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerTabbedBrowsing "NewTabPageShow" = "0"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetFIREFOX.EXEshellopencommand "(Default)" = "C:Program FilesMozilla Firefoxfirefox.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetGoogle Chromeshellopencommand "(Default)" = "C:Documents and SettingsBleepingLocal SettingsApplication DataGoogleChromeApplicationchrome.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXEshellopencommand "(Default)" = "C:Program FilesInternet Exploreriexplore.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetOperashellopencommand "(Default)" = "C:Program FilesOperaOpera.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetOpera.exeshellopencommand "(Default)" = "C:Program FilesOperaOpera.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetSafari.exeshellopencommand "(Default)" = "C:Program FilesSafariSafari.exe" http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetSEAMONKEY.EXEshellopencommand "(Default)" = "C:Program FilesSeaMonkeyseamonkey.exe http://www.sweet-page.com/?type=sc&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Default_Page_URL" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Default_Search_URL" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Search Page" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerMain "Start Page" = "http://www.sweet-page.com/?type=hp&ts=<timestamp>&from=tugs&uid=<hard-disk-id>"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch "CustomizeSearch" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"

HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearch "SearchAssistant" = "http://www.sweet-page.com/web/?type=ds&ts=<timestamp>&from=tugs&uid=<hard-disk-id>&q={searchTerms}"

Sweet-page.com Browser Hijacker im HijackThis-Log:

Code:

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}

R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}

R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.sweet-page.com/?type=hp&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130

R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}

R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://www.sweet-page.com/web/?type=ds&ts=1393350773&from=tugs&uid=VBOXXHARDDISK_VB9ad64b62-231b0130&q={searchTerms}

O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:Program FilesSupTabSupTab.dll

O23 - Service: IePlugin Service (IePluginService) - Cherished Technololgy LIMITED - %CommonAppData%IePluginServicePluginService.exe

O23 - Service: Wpm Service (Wpm) - Cherished Technololgy LIMITED - %CommonAppData%WPMwprotectmanager.exe