Comments on: How to remove trojan DNSChanger/DNS hijacker (Redirect Virus/Trojan Fix)

By: Patrik

Patrik — Fri, 28 May 2010 13:19:18 +0000

marc, please begin a new topic in our Spyware removal forum. I will check your computer.

By: marc

marc — Wed, 26 May 2010 11:58:47 +0000

Hi Patrick, got a question for you about the trojan.dnschanger. It appears I have sucessfully removed the virus, with one small exception, I’m getting a Malwarebyte pop-up that it is blocking a file (mentioning it is a trojan.DNSChanger), and giving me the options of ignore, quarantine etc… I keep choosing quarantine, but it’s not going away, happens every time the comp starts up, about 3-5 mins. after booting.

Everything seems fine with the computer, except that one thing. Last thing done was Combofix in safe mode, followed by Malwarebyte quick scan in safe mode (found no infections).

Any suggestions?

By: Patrik

Patrik — Sat, 01 May 2010 04:31:30 +0000

Alex, run HijackThis. Click “Do a system scan only” button. Now select all O17 entries by placing a tick in the left hand check box. Once you have selected all entries, close all running programs then click once on the “fix checked” button.
Reboot your computer.

By: Alex

Alex — Fri, 30 Apr 2010 13:47:38 +0000

Patrik. thank you for the reply.
I don’t know how to use Hijackthis.
What do you mean by checking the O17 series?

By: Patrik

Patrik — Wed, 28 Apr 2010 05:58:53 +0000

Alex, firstly check O17 entries in your HijackThis log. Fix them all.
if it does not help, then start a new topic in our Spyware removal forum. I will help you.

By: Patrik

Patrik — Wed, 28 Apr 2010 05:49:33 +0000

John, probably your version of the trojan has changed dns records in the Windows registry only (no active trojan components). You need run HijackThis and fix all O17 entries. Once finished, you need follow the first additional step above.

By: Alex

Alex — Tue, 27 Apr 2010 05:53:03 +0000

Sorry Patrik. I forgot to tell you I can’t go into SAFE MODE. My keyboard freeze up when I try to select SAFE MODE. I tried rebooting but something is stopping the installation…

By: Alex

Alex — Tue, 27 Apr 2010 05:51:51 +0000

Hello Patrik. I think I had a virus called Virus Protector. I followed the steps and it seems like I got rid of it!! But it didn’t stop there. When I scan with Malwarebytes Anti-Malware, it says I have the Trojan DNS Hacker & Trojan Banker. I have tried the Avenger, RegCure, WinASO Registry, TDSSKiller, ComboFix, TrojanRemover, HijackThis, and GMER. I can’t update Virus updates & Windows update. Other than that, it seems like the computer got alot faster.. including the internet speed. Please help*

By: John

John — Tue, 27 Apr 2010 03:41:37 +0000

So I was able to use this software (through bringing the exe on a USB) to eradicate all the infected files it found and I thought I would be fien after that. However, the DNS Changer Trojan remains. I still get popups for fake spyware antiviruses and pages redirect to random web searches.

Basically, before I was able to clean my computer, neither Avenger nor TDSSkiller nor any other of the variants of step one worked for me. However, after the cleaning, I can now access all of these. The problem is that all of these come up with no results and/or infections regarding the DNS trojan, even though the problem persists. I even tried to clear my DNS cache through Network Connections to no avail. Can you shed any light on the issue?

By: Patrik

Patrik — Wed, 21 Apr 2010 13:09:50 +0000

Stephanie, try the instructions.