autohaus-bender.de: a car dealer's website listed for ClickFix and FileFix malware files, and what to do if you pasted a command
autohaus-bender.de is the website of a German car dealer, and on 17 October 2026 URLhaus listed three web addresses on it (two under /api/ and one picture path) as malware downloads tagged ClickFix and FileFix. Those tags describe a trick where a web page persuades you to paste a command into Windows yourself; visiting a page and doing nothing else is not the trick.
If you only saw the name in a log or a warning, nothing is proven; if you pasted a command that a page told you to paste, treat the PC as compromised: change your passwords from another device, then scan and clean or reset Windows.
Facts checked October 17, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with a command you pasted into Windows after a web page told you to, which fetched files from autohaus-bender.de.
Do it yourself · free Remove autohaus-bender.de (ClickFix and FileFix malware downloads) yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Autohaus-bender.de (ClickFix and FileFix malware downloads): summary
| Type | A website listed by URLhaus for three malware download addresses tagged ClickFix and FileFix, a trick that makes you paste a command yourself |
|---|---|
| Risk | High if you pasted a command from a web page and it reached these files: passwords and files may be taken, and a remote controller may be present. Low if you only saw the name |
| Symptoms | Often none. A long command in the Run box history or in the File Explorer address bar history, and built-in programs such as powershell.exe running with no reason, are the signs in the reports |
| How to get rid of it | Change passwords from another device, run Microsoft Defender Offline, remove what you can tie to the command, and reset Windows if you are not sure |
| Our check (17 October 2026) | One plain request from our server to the home page: HTTP 200, an ordinary car dealer page. That clears nothing; the rating comes from URLhaus |
| Running since / first seen | First reported 17 October 2026 at 15:22 UTC; the domain's registration date is unknown to us |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Platform | Windows first; Microsoft says ClickFix also targets macOS. Nothing we read says phones are affected |
|---|---|
| Detection names | None is known for these exact files, because we did not open them and URLhaus gave no family name. For the ClickFix technique in general, Microsoft's post lists Trojan:Win32/ClickFix, Trojan:Script/ClickFix, Trojan:HTML/FakeCaptcha, Behavior:Win32/ClickFix, Behavior:Win32/SuspClickFix and Behavior:Win32/RegRunMRU. Whether Defender uses any of them for these files is not confirmed |
| Name | Autohaus-bender.de |
| Evidence | 3 write-ups by security sites; details still limited |
| First seen | 17 October 2026 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 17 October 2026 |
Facts checked on 17 October 2026 against the URLhaus data for autohaus-bender.de held in our database (the abuse.ch host page itself was not fetched), an RDAP lookup that returned no record, one plain request of our own to the home page, and published pages by Microsoft, Check Point, Intel 471 and the FTC.
We did not download the reported files and we infected no PC; the removal steps follow Microsoft's pages and were not tried on a live infection.
What autohaus-bender.de is, and what we know about it
autohaus-bender.de is not a program on your PC. It is a web address that answers with an ordinary company page, and that the abuse.ch project URLhaus lists as a place where malware files were served. We found no public write-up of this address, so what follows is what URLhaus shows, what our server saw, and what Microsoft, Check Point and Intel 471 have published about the technique the tags name.
- 1
What URLhaus lists
Three addresses on autohaus-bender.de: hxxps://autohaus-bender[.]de/api/cm-token, hxxps://autohaus-bender[.]de/img/cachefeed.jpg and hxxps://autohaus-bender[.]de/api/poly-token. They were added on 17 October 2026 at 15:22:09, 15:22:10 and 15:22:11 UTC. All three were marked online when we read the data, all carry the threat label malware_download, and one reporter, YoshmanSJ, filed all three.
- 2
What the tags mean
ClickFix and FileFix are names for social engineering tricks, not for one malware family. In both, a web page gets the visitor to paste a command and run it. The tags say the reporter saw these addresses used in that kind of attack. They do not say which malware is at the end, and URLhaus gave no family name here.
- 3
What we could not confirm
We did not download any of the three addresses, so we cannot tell you what they return, which malware sits behind them, or where it reports to. We also did not see the web page that shows the lure to a victim. Whether the dealer's own site was broken into, or whether the addresses were created by someone else with access to it, is not something any source we read says.
- 4
What this means for you
If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a Windows PC where someone followed on-screen instructions to paste a command and press Enter. The paths look like file names a script would ask for (a token under /api/ and a .jpg), not pages a person would browse to.
- Kind of threat
- A web server listed for malware downloads tagged ClickFix and FileFix: the visitor is talked into running the first command
- Where the files are
- hxxps://autohaus-bender[.]de/api/cm-token, /api/poly-token and /img/cachefeed.jpg on the normal secure web port
- What the site looks like
- Our plain request on 17 October 2026 got HTTP 200 and a page titled Unternehmen | Autohaus Bender 24 GmbH, served by nginx
- Domain registration
- Unknown. Our registration lookup (RDAP) returned no record for the domain, so we cannot give a creation date or a registrar
- URLhaus entries
- 3 addresses, all added 17 October 2026 between 15:22:09 and 15:22:11 UTC, all online when we read the data
- Platform
- Windows first. Microsoft says ClickFix targets Windows and, more recently, macOS. We do not know which system these files are made for
What autohaus-bender.de (ClickFix and FileFix malware downloads) does on an infected PC
What we checked on 17 October 2026, and what we could not
Our check was one plain web request from our server to the home page. It is not a browser visit: nothing was clicked, no script ran in a browser and we did not open the three reported addresses. A quiet answer like this clears nothing, because a lure page can show itself only to certain visitors or only after a click.
Our check, 17 October 2026
- The home page answered normallyHTTP 200, no redirect to another domain, page title Unternehmen | Autohaus Bender 24 GmbH, server software nginx. It looks like the page of a real company.
- Why that is not a clean resultThe reports name /api/ and /img/ paths, not the home page. A site can look ordinary at the front while a hidden path serves something else, and a plain request from a server is not what a victim's browser sends.
- Notification requestNot mentioned in the page we received. This is a plain request, so it would not run scripts.
- URLhaus listingThree addresses tagged ClickFix and FileFix, labelled malware_download, all online in our copy of the data on 17 October 2026.
- Downloads and the lure pageWe did not download the three addresses and did not find or view any page with a fake check or an upload box. We cannot tell you what a visitor sees.
Dangerous: treat the reported addresses as malware downloads Our check was one plain request and proves nothing either way. The rating comes from the three URLhaus reports and their tags. Do not open the three addresses, and never paste a command a web page gives you. The company behind the site may be an innocent victim; see the section for site owners.
What happened on 17 October 2026
Everything we know about this address happened within one afternoon. The dates and times come from the URLhaus data we hold; the times are UTC.
Before 17 October 2026
Registration date unknown
Our RDAP lookup for autohaus-bender.de found no record, so we do not know when the domain was registered or by whom. We draw no conclusion from that: not every registry answers this kind of lookup.
17 October 2026, 15:22:09 UTC
/api/cm-token is reported
The first address is added to URLhaus with the threat label malware_download and the tags ClickFix and FileFix.
17 October 2026, 15:22:10 UTC
/img/cachefeed.jpg is reported
One second later the second address is added with the same label and tags. It ends in .jpg, but URLhaus lists it as a malware download, so we do not treat it as a harmless picture.
17 October 2026, 15:22:11 UTC
/api/poly-token is reported
The third address follows with the same label and tags. The same reporter, YoshmanSJ, filed all three.
The three reports, one second apart. All three were online when we read the data. 17 October 2026
Our plain request
Later the same day our server asked for the home page and got HTTP 200 with an ordinary company title. All three reported addresses were still listed as online.
What the pattern suggests, and what it does not: three entries from one reporter in three seconds look like one batch filed after one investigation, not three separate sightings. That is our reading of the timestamps. It does not tell us how long the addresses had been serving files, and it does not tell us whether the dealer knows about them.
How ClickFix gets a person to infect their own PC
ClickFix is a social engineering technique in which a web page tricks you into running a malicious command yourself. Microsoft Threat Intelligence described it in a post on 21 August 2025. We did not see the page for this site; this is the general technique.
- 1
A page shows a fake check or error
Microsoft says victims usually arrive through phishing emails, malvertising or compromised websites. The page often imitates a trusted brand or a verification step: a CAPTCHA, Cloudflare Turnstile, reCAPTCHA, a Discord check or a Word error message.
- 2
A command is copied without you noticing
You click a button that says Verify or How to fix. The page silently places a malicious command on your clipboard. You see no download and no warning, because nothing has been downloaded yet.
- 3
You are told to paste it
The instructions tell you to open the Windows Run dialog, Windows Terminal or PowerShell, paste, and press Enter. Microsoft notes that on macOS the lure showed Windows instructions while the copied command asked for the user's system password.
- 4
The command fetches the malware
Because you launched the command yourself, automated tools may not stop it, Microsoft says. Many payloads are fileless and run in memory through built-in Windows programs such as msbuild.exe, regasm.exe or powershell.exe.
The rule that protects you is short: a real website never needs you to paste text into the Run box, a terminal or an address bar. If a page asks, close it.
How FileFix differs from ClickFix
FileFix is the same idea with a different window. Check Point's write-up says the researcher mr.d0x introduced it on 23 June 2025 as a stealthier successor to ClickFix. URLhaus tagged all three addresses with both names, so the reporter saw, or expected, either style.
| Question | What the sources say | Source |
|---|---|---|
| Where do you paste? | ClickFix: the Windows Run dialog, Windows Terminal or PowerShell. FileFix: the address bar of a real File Explorer window that the page opens, usually from a file upload button | Microsoft; Check Point |
| What do you think you are doing? | Pasting a file path. The command is hidden before a PowerShell comment marker, so the visible part looks like a path to a document such as an HR policy | Check Point |
| Why is it harder to stop? | Intel 471 says no downloaded file is delivered, so Mark of the Web protections have nothing to mark, and the command runs from a clipboard string in a window people trust | Intel 471 |
| Is there a trace afterwards? | Intel 471 says Windows often records the pasted string in the File Explorer address bar history, and a full PowerShell string or a URL there is a strong sign that a FileFix run succeeded | Intel 471 |
| Which malware follows? | Not decided by the trick. Microsoft lists infostealers, remote access tools, loaders and a rootkit as ClickFix payloads. For these three addresses the payload is not known | Microsoft |
What autohaus-bender.de (ClickFix and FileFix malware downloads) can steal or download
What could be on the other end of the command
The tags do not name a malware family, so we cannot say what these three addresses deliver. What we can say is what Microsoft found at the end of ClickFix chains in general. Treat the list as the range of possible outcomes, not as a description of this server.
Seen at the end of ClickFix chains (Microsoft)
- Lumma Stealer
- Lampion
- AMOS stealer on macOS
- Xworm
- AsyncRAT
- NetSupport
- SectopRAT
- ScreenConnect abuse
- Latrodectus loader
- MintsLoader
- DarkGate
- r77 rootkit
| Kind of payload | What it means for you | Source |
|---|---|---|
| Infostealer | Microsoft calls Lumma Stealer the most prolific ClickFix payload. A stealer's purpose is to collect saved logins and similar data from the PC | Microsoft |
| Remote access tool | Xworm, AsyncRAT, NetSupport, SectopRAT and ScreenConnect let another person use the PC from a distance | Microsoft |
| Loader | Latrodectus, MintsLoader and DarkGate are programs whose job is to bring in more malware | Microsoft |
| Rootkit | The r77 rootkit was linked to the OBSCURE#BAT campaign and hides itself on the PC | Microsoft |
| This server's payload | Not known. We did not open the files and URLhaus gave no family name | Not available |
If you own or run autohaus-bender.de
A company page with a normal title and three bad addresses is the shape of a hacked site more often than that of a criminal one, but we cannot prove either. The steps below are our own judgement about what a site owner should do; they are not taken from a vendor procedure for this case.
- 1
Look at the three paths yourself, safely
Check, from the server or the hosting panel and not from a browser on a work PC, whether /api/cm-token, /api/poly-token and /img/cachefeed.jpg exist as files or as routes your own software handles. If you did not create them, treat them as planted.
- 2
Do not just delete and move on
Planted files usually mean a way in exists: a stolen administrator or hosting password, an outdated content management plugin, or an upload form. Find what created the files, using the access and error logs for the time around 15:22 UTC on 17 October 2026 and earlier.
- 3
Change every credential from a clean device
Hosting panel, FTP or SSH, database, content management administrators and the email accounts tied to them. Turn on two step sign in where it is offered.
- 4
Restore from a clean copy and update
If the site software or a plugin is out of date, update it. If you cannot tell what else was changed, restore the site files from a backup made before the first sign of trouble, or ask your hosting provider or a web agency to do a clean rebuild.
- 5
Look for a lure page and for injected script
ClickFix pages are often placed on compromised websites, Microsoft says. Check your pages for a fake CAPTCHA, a verification box or an upload button that you did not build, and for script tags you do not recognise.
- 6
Tell your hosting provider
Hosting providers handle abuse reports and can help with logs. After you have cleaned up, you can ask abuse.ch to review the URLhaus entries. We do not know how long a review takes.
What this can cost you
Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where someone pasted a command from a page and pressed Enter, and where that command reached one of the reported addresses. What follows depends on the payload, which we do not know.
- High
Passwords and accounts
If a stealer ran, saved browser logins are at risk. Changing passwords on the same PC does not help, because whatever is watching sees the new ones.
- High
Someone using your PC live
If the payload was a remote access tool, the controller can return at any time. Microsoft lists several such tools among ClickFix payloads.
- High
Crypto and banking
Crypto sent from a stolen wallet cannot be reversed. A bank session that you opened on the PC can be watched. Whether this payload targets wallets is not known.
- Medium
More malware on the same PC
Microsoft names loaders such as Latrodectus, MintsLoader and DarkGate among payloads. A loader brings in other programs after the first.
- Medium
A hidden component
Microsoft links the r77 rootkit to one ClickFix campaign. A rootkit hides itself, so a clean quick scan is weak evidence.
- Low
Nothing, if you only saw the name
A name in a block list, a log or a warning is not an infection.
What you may notice, and what you may not
Payloads delivered this way are built to be quiet, and many run in memory. The signs below come from Microsoft and Intel 471 and from what the possible payloads imply. None is certain, and many victims notice nothing.
| Sign | What the reports show |
|---|---|
| A long command in the Run box history | Microsoft says the RunMRU registry key records what was typed in the Run dialog, and commands there that use powershell, mshta, rundll32 or curl, or that look scrambled, are a sign |
| A web address or PowerShell text in the File Explorer address bar history | Intel 471 says a full PowerShell string or an HTTP address in that history is a strong sign of a successful FileFix run |
| A built-in Windows program running with no reason | Microsoft names msbuild.exe, regasm.exe and powershell.exe as programs used to run payloads in memory. They are real Windows programs, so one running with high network use and no reason is worth a look |
| A Defender detection or a blocked item | Look in Protection history. Microsoft's ClickFix post lists the detection names Trojan:Win32/ClickFix, Trojan:Script/ClickFix, Trojan:HTML/FakeCaptcha and Behavior:Win32/SuspClickFix. We do not know which, if any, applies to these files |
| Accounts you did not touch | Logins from new places, password reset emails and messages sent from your accounts. This follows from stolen logins; it is our reading, not a quote |
| Nothing at all | Fileless payloads leave little behind. A PC that looks normal is not proof of a clean PC |
How to check the PC for autohaus-bender.de (ClickFix and FileFix malware downloads)
Who can meet this, and how
Customers of a car dealer are not the target by themselves. The people at risk are whoever lands on the lure, wherever it is, and then follows its instructions. Whether a lure is shown on autohaus-bender.de itself, or only links to its addresses from elsewhere, we do not know.
- 1
A fake check on a web page
Microsoft names phishing emails, malvertising and compromised websites as the ways victims arrive. A visitor to a hacked site could see a fake CAPTCHA that was injected into it.
- 2
A page that opens File Explorer for you
Check Point describes FileFix pages that open a real Explorer window from an upload button and tell you to paste a path. If a page asks you to paste something into that address bar, stop.
- 3
A script that was already running
The paths named /api/ tokens and a .jpg look like files that a script or a command would request, not something a person would type. A device in your network logs that asked for them may have run a pasted command.
- 4
Only a name in a log
A security product may block the address and show it in a report. That is the system working, and it is not an infection by itself.
Check your PC before you delete anything
Start with the question that matters: did a web page tell you to paste something into the Run box, a terminal or the File Explorer address bar, and did you do it? If you saw the name in a log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.
While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.
- 1
Disconnect first
Turn off Wi-Fi or unplug the network cable. Many payloads need the connection to send data out or take orders.
- 2
Find which device asked for the address
If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.
- 3
Look at the Run box history
Microsoft names the RunMRU registry key as the record of Run dialog commands. In Registry Editor, go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU and read the entries without running anything. A long command with powershell, mshta, rundll32 or curl, or with scrambled text, is a sign. Write it down and do not paste it anywhere.
- 4
Look at the File Explorer address bar history
Intel 471 says Windows often records pasted text in the address bar history. Open a File Explorer window, click the address bar and look at the drop down list. A PowerShell command or a web address in it, which you did not type as a folder path, is a strong sign.
- 5
Look at Task Manager and Startup apps
Open Task Manager and sort by network or CPU. Look for powershell.exe, msbuild.exe or regasm.exe running with no reason, and open Settings > Apps > Startup for names you did not install. Their presence is not proof, and their absence does not clear the PC.
- 6
Open Protection history
In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time you pasted the command. Microsoft says the results of an offline scan also appear there.
- 7
Check your accounts from another device
Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.
- 8
A scan helps, but it does not clear the PC
A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site check: one data point. We did not infect a PC with these files, so the order of the plan is our judgement from Microsoft's pages, not a tested result.
How to remove autohaus-bender.de (ClickFix and FileFix malware downloads)
How to remove autohaus-bender.de
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like autohaus-bender.de add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after autohaus-bender.de, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of autohaus-bender.de that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Autohaus-bender.de can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
If you use a Mac, an iPhone or an Android phone
The tags describe a trick that Microsoft says targets Windows and, more recently, macOS. We found no source that says these three addresses affect a phone, and we do not know which system their files are made for.
| Your device | What we know | What to do |
|---|---|---|
| Mac | Microsoft says the lure showed Windows instructions while the copied command asked for the user's system password. It names AMOS as a macOS stealer. We do not know if these files are for Mac | If you pasted a command into Terminal and typed your password, treat the Mac as compromised and change passwords from another device. Do not follow the Windows steps on a Mac |
| iPhone or iPad | The trick needs a place to paste and run a command, and none of the sources describe it on iOS | Nothing to remove for this threat. If you typed a password on a suspicious page, change it |
| Android | No source we read mentions it | Nothing to remove for this threat; change passwords if you entered any |
After removal: passwords, accounts and prevention
After a clean PC: protect what was taken
The PC is one half. The other half is everything you typed or stored on it from the moment you pasted the command. The order matters: another device first, then the PC.
- 1
Change passwords from a clean device
Start with email, because it resets everything else, then bank, work, cloud storage and crypto. Anything typed on the PC after the command ran may be known to whoever controls the payload.
- 2
Sign out other sessions and turn on two step sign in
The FTC says to change the password, sign out of the account on all devices and turn on two factor authentication if it is offered. Check the email address and phone number on the account, and look for auto forwarding rules you did not create.
- 3
Move crypto first if a wallet was on the PC
If a seed phrase or wallet file was ever on the PC, assume it may be known. Create a new wallet and recovery phrase on a clean device and move the funds there.
- 4
Run Microsoft Defender Offline
Microsoft says to open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Save your work first: Windows signs you out and restarts, and the scan takes about 15 minutes. It runs outside the normal Windows environment, which helps against rootkits. If BitLocker is on the system drive, Microsoft says to suspend it first or the restart may ask for the recovery key. Results are under Protection history.
- 5
Remove what the check found, with care
If Startup apps or Task Scheduler showed an entry that you can tie to the command, remove it. If you cannot tell, do not guess: the safe answer is the reset below.
- 6
If you are not sure, reset Windows
Go to Settings > System > Recovery > Reset this PC. Keep my files removes apps and settings but keeps personal files; Remove everything wipes the PC. For a PC where a pasted command ran an unknown payload, the full wipe does not depend on finding every piece. Back up documents first.
- 7
Restore only documents by hand
Copy back documents and photos, not programs, and not a full system image made after the first contact. Install apps from their makers' own sites.
- 8
Rebuild logins in a password manager
Do not let the browser save passwords again on a PC that was watched. Use a password manager and an authenticator app or security key for two step sign in.
- 9
Watch your money and your accounts
Check card statements and exchange logs for a few weeks and turn on alerts. The FTC says to report stolen personal information at IdentityTheft.gov, which gives a personalised recovery plan.
How to avoid this kind of trick
The trick works only if a person runs the command. That makes the person the control point, and a few firm rules close it.
Do
- Close any page that tells you to press Windows key + R, open a terminal or paste into the File Explorer address bar to prove you are human or to fix an error.
- Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.
- Use a password manager and two step sign in, so one stolen password is not enough.
- At work, tell your IT team about any page that asked you to paste a command. Microsoft suggests training and, for companies, limiting the Run dialog and enabling PowerShell logging.
- Keep a backup of documents on a disk that you unplug.
Don't
- Do not paste anything into the Run box, a terminal or an address bar because a web page told you to.
- Do not trust a page because it belongs to a company you know. Hacked sites are used for these lures.
- Do not change your passwords on the PC you suspect.
- Do not open the reported addresses to see what they are.
- Do not rely on a quiet scan to say that you are safe.
Questions about autohaus-bender.de (ClickFix and FileFix malware downloads)
What is autohaus-bender.de?
It is the website of a German car dealer, Autohaus Bender 24 GmbH according to the title our server received on 17 October 2026. URLhaus, the malware tracking project run by abuse.ch, lists three addresses on it as malware downloads tagged ClickFix and FileFix.
The reports were filed on 17 October 2026 between 15:22:09 and 15:22:11 UTC. It is not a program on your PC. We did not download the files, so what they contain is not confirmed by us.
Is autohaus-bender.de safe to open?
We cannot clear it. Our plain request to the home page got an ordinary page, but the reports name other paths, and a lure page can show itself only to some visitors or after a click.
Do not open the three reported addresses, and never paste a command that a page gives you. The business may be an innocent victim whose site was misused, but until the reports are gone, treat the site as unsafe.
What do the tags ClickFix and FileFix mean?
They are names of tricks, not of a virus. In ClickFix, Microsoft says, a page makes you copy a malicious command and paste it into the Windows Run dialog or a terminal.
In FileFix, Check Point says, you paste the command into the File Explorer address bar, disguised as a file path. In both you run the command yourself, which is why a download warning may never appear. The malware family at the end is not named in the reports.
I saw autohaus-bender.de in a log or a warning. Am I infected?
Not necessarily, and the name alone proves nothing. It does mean that something asked for it, and a person does not usually type paths like /api/cm-token by hand. Find which device it was and disconnect it.
Check the Run box history, the File Explorer address bar history, Task Manager, Startup apps and Protection history, and do account changes from another device. If a security product blocked the request, it did its job.
I pasted a command from a website. What do I do now?
Disconnect the PC from the network and stop using it for banking, email or work. From another device, change your passwords, starting with email, sign out of all sessions and turn on two step sign in.
Then run a Microsoft Defender Offline scan on the PC and read Protection history. If you cannot tell what ran, reset Windows with Remove everything and restore documents by hand. We follow Microsoft's pages here and did not test the steps on an infected PC.
How do I remove the malware from Windows?
We do not know which malware these files deliver, so there is no single removal recipe.
The route that does not depend on the family is: change passwords from another device, run Microsoft Defender Offline (Windows Security, Virus and threat protection, Scan options), remove startup entries you can tie to the pasted command, and reset Windows if you are not sure. A clean scan is one data point and does not clear the PC.
Does this affect Mac, iPhone or Android?
We found no source that says these addresses affect a phone. Microsoft says ClickFix targets Windows and, more recently, macOS, where the copied command asked for the user's system password and the AMOS stealer was one payload.
If you pasted a command into Terminal on a Mac and typed your password, treat the Mac as compromised. On iPhone and Android there is nothing to remove for this threat; change any password you typed on a suspicious page.
I run the website. What should I do?
Check whether /api/cm-token, /api/poly-token and /img/cachefeed.jpg exist and whether you made them. If not, treat them as planted and look in your logs around 15:22 UTC on 17 October 2026 and before for how they got there.
Change hosting, FTP, database and administrator passwords from a clean device, update your content management software and plugins, restore from a clean backup if needed, and tell your hosting provider. This is our judgement, not a vendor procedure.
Will resetting Windows fix everything, and are my accounts safe afterwards?
A reset with Remove everything wipes programs and startup entries, which is the answer that does not depend on finding every piece. It does not undo what was already taken.
Passwords, session logins and crypto seed phrases that a stealer or remote tool saw stay exposed until you change them, from another device, and turn on two step sign in. Restore documents by hand, not a full system image made after the first contact.
Will Fortect remove autohaus-bender.de?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For autohaus-bender.de, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Microsoft Threat Intelligence: Think before you Click(Fix), analyzing the ClickFix social engineering technique (21 August 2025) (read October 17, 2026)
- Check Point Blog: FileFix, a stealthier successor to ClickFix (mr.d0x, 23 June 2025) (read October 17, 2026)
- Intel 471: Threat hunting case study, FileFix (read October 17, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) (read October 17, 2026)
- FTC: Email or social media hacked? Here's what to do (read October 17, 2026)