Jump to content

Issue with trojan.DNSChanger....can't solve or find root.

Recommended Posts

I am posting this from home and do not have any of the HJT logs or MWB logs....sorry. But I really don't think those would help with my particular issue anyway.

At my Wife's work her Boss' PC was infected with antimalware doctor, so I ran MWB but couldn't update. Got around it, removed it. No problems there. After scanning it one last time I found the DNSChanger trojan, so I removed them, scanned again....found it again. Couldn't remove it. Ran HJT and saw the entries with the IP ranges, "fixed" them, rescanned, found the trojan again.

Now he is connected to the work network, he has a network drive P:, which I scanned....and found DNSChanger, deleted it, scanned his PC, found it again. So I ran MWB on other PCs in the office, both on their C: drive and on the same P: network drive and no other computer found this trojan. It is ONLY showing up on her Boss' PC...and I can't get rid of it. So I disconnected the infected PC from the ethernet cable, and ran MWB on the server itself...and found NOTHING. Ran it on his PC, found it, deleted it. Reconnected to the network and it came right back again.

So I start really looking into this trojan and discover that it can alter the router itself. So I would need to disconnect the PC, clean it, reset the router, and THEN it should be gone. But I am wondering if it is in the router, why are no other PCs effected as they ALL use the same router. They all use the same network drive...but only his PC stays infected.

Any input would be helpful. I assume I need to reset the router, which should be fun....disconnect the PC and scan it, then it should be finally removed. But I am hoping there is an easier way. The trick to me is that with 5 PCs connected to the same router, switch, and server....why is it ONLY his PC that stays infected?

Link to post
Share on other sites

  • 1 month later...
  • 2 weeks later...
  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.