Trojan.DNSChanger.ACMB2

Short bio

Trojan.DNSChanger.ACMB2 is a generic detection for changes made by a special kind of Trojan that changes users’ DNS settings on the affected Windows system.

Type and source of the infection

The changes made by the DNS changing malware can be found in the registry values called NameServer under the keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID of the interface}

and

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Protection

Malwarebytes protects users from Trojan.DNSChanger.ACMB2 by using real-time protection to block the trojans that make these changes.

block Trojan.DNSChanger

Malwarebytes blocks Trojan.DNSChanger

Remediation

Malwarebytes can detect and remove Trojan.DNSChanger.ACMB2 without further user interaction. The removal also takes care of some required actions to undo other changes:

  • Reset the DNS settings to something safe
  • Clear the browser cache
  • Remove the jobs (Scheduled Tasks) that were responsible for the change (if still present)

Procedure:

  1. Please download Malwarebytes to your desktop.
  2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  3. Then click Finish.
  4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  7. Restart your computer when prompted to do so.

Screenshots

Cybersecurity info you can’t do without

Want to stay informed on the latest news in cybersecurity? Sign up for our newsletter and learn how to protect your computer from threats.

Select your language