Trojan.DNSChanger.ACMB2

Short bio

Trojan.DNSChanger.ACMB2 is Malwarebytes’ generic detection name for changes made by a type of Trojan that changes users’ DNS settings on affected Windows systems.

Type and source of the infection

The changes made by the DNS-changing malware can be found in the registry values called NameServer under the keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID of the interface}

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Protection

Malwarebytes protects users from Trojan.DNSChanger.ACMB2 by using real-time protection to block the Trojans that make these changes.

Malwarebytes blocks Trojan.DNSChanger

Remediation

Malwarebytes can detect and remove Trojan.DNSChanger.ACMB2 without further user interaction. The removal also takes care of some required actions to undo other changes:

• Reset the DNS settings to something safe
• Clear the browser cache
• Remove the jobs (Scheduled Tasks) that were responsible for the change (if still present)

Procedure:

1. Please download Malwarebytes to your desktop.
2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
3. Then click Finish.
4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
6. When the scan is complete, make sure that All Threats are selected, and click Remove Selected.
7. Restart your computer when prompted to do so.