Trouble after Zlob removal?

[Brindlecat]

When I run S&D, it finds Zlob.DnsChanger, and removes it when I tell it to.

Then, everything works fine -- for a few minutes. It doesn't take long, though, until common website urls are unable to be found (e.g. google).

The only way I can get back to accessing those websites is if I do a system restore to before I cleaned Zlob.DnsChanger off.

Am I stuck with it? Or am I missing something.

Any help is appreciated; Thanks.

PS -- I have the latest updates for 1.4.

[marius]

I have the same problem. Everytime I run Spybot there is always the Zlob.DNSchanger found. If I fix/remove my internet will be unaccessible.

Is this a new trojan virus? I cant find any thread or forum talking about this.

Please help how to get rid of this.

Edit:
Second post containing a fix posted at SWI for another user removed.

Please see:
http://forums.spybot.info/showpost.php?p=16905&postcount=2

Best regards.

[tashi]

Hi Brindlecat.

If you can find the file/s, please zip and send to: detections(AT)spybot.info (Replace AT with @)

Also produce a complete Spybot bug report:

Open Spybot-S&D and start a scan ("check for problems"). After the scan, right-click in the results field and choose either "Save full report to file..." or
"Copy full report to clipboard".
Include that in the email.

Update: Please see if this pertains to your problem. http://forums.spybot.info/showthread.php?t=14547

[lucianotbrandao]

I have the same problem. PLEASE... SOMEBODY HELP ME!!!!!!!


--- Search result list ---

Zlob.DNSChanger: TCP/IP Settings #1 (Undefined) (Modificação no registo, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{E3916C1D-AF15-46DD-8285-DAA692E77F46}\NameServer=207.68.160.190 194.25.2.129 208.67.222.222 207.68.160.190 194.25.2.129 208.67.222.222


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-08-06 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2007-05-23 advcheck.dll (1.5.3.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2007-01-02 Tools.dll (2.0.1.0)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-06-13 Includes\Cookies.sbi (*)
2007-05-30 Includes\Dialer.sbi (*)
2007-06-13 Includes\DialerC.sbi (*)
2007-06-13 Includes\Hijackers.sbi (*)
2007-06-13 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2007-06-13 Includes\KeyloggersC.sbi (*)
2007-05-30 Includes\Malware.sbi (*)
2007-06-13 Includes\MalwareC.sbi (*)
2007-03-21 Includes\PUPS.sbi (*)
2007-06-13 Includes\PUPSC.sbi (*)
2007-06-13 Includes\Revision.sbi (*)
2007-05-30 Includes\Security.sbi (*)
2007-06-13 Includes\SecurityC.sbi (*)
2007-06-06 Includes\Spybots.sbi (*)
2007-06-13 Includes\SpybotsC.sbi (*)
2005-02-17 Includes\Tracks.uti
2007-05-16 Includes\Trojans.sbi (*)
2007-06-13 Includes\TrojansC.sbi (*)
2007-06-06 Plugins\TCPIPAddress.dll

[taco006]

I am having the same problem as everyone else here. also when i rerun spybot it still finds Zlob.DNSChanger. is there another way to get rid of this thing or what? are we stuck with it? it also appears to have suddenly popped up after everyone got the tcp/ip plugin. lots of info would be greatly appreciated as i have been using spybot for 5 years now and never had a problem like this until now. please somehow help us out.

[helpneeded]

I have been having the same problem with Zlob; I became curious. I corrected my IP address. So now I check my IP address just prior to running spybot (after I had changed my IP address to my real one), and it showed the correct one. I ran spybot and it shows that I have Zlob dns changer. I check my IP address again before I do anything, and I still have my correct IP address. I select the fix option. I get the green check marks. I check my IP address again, and now my IP address has been changed to the IP address in the spybot Zlob message. Has anyone else noticed this? I check using the command prompt and in my registry each time. It does not change until I have spybot fix it.

[helpneeded]

The IP address that keeps changing is the dns server IP address.

[marius]

I have the same problem. Everytime I run Spybot there is always the Zlob.DNSchanger found. If I fix/remove my internet will be unaccessible.

Is this a new trojan virus? I cant find any thread or forum talking about this.

Please help how to get rid of this.

Edit:
Second post containing a fix posted at SWI for another user removed.

Please see:
http://forums.spybot.info/showpost.php?p=16905&postcount=2

Best regards.

Strange forum!
Many persons like me who needs help. Why did you deleted my post? Why dont you post solutions rather than deleting post that can help other persons.
I have successfully removed the virus. But Spybot dont have solution! its useless!

Those who have problem, PM me I will send you instruction how to delete the virus. The Sbybot S&D dont have solution at this time maybe. Thats why they cant post here. My solution was taken from other forum and thats why they deleted.

[WantMB]

Marius,

Can you please send me the fis, I am having the same problem. I am also curious as to why they would not post the fix?

Thanks,



I have the same problem. Everytime I run Spybot there is always the Zlob.DNSchanger found. If I fix/remove my internet will be unaccessible.

Is this a new trojan virus? I cant find any thread or forum talking about this.

Please help how to get rid of this.

Edit:
Second post containing a fix posted at SWI for another user removed.

Please see:
http://forums.spybot.info/showpost.php?p=16905&postcount=2

Best regards.

[tashi]

I am having the same problem as everyone else here. also when i rerun spybot it still finds Zlob.DNSChanger. is there another way to get rid of this thing or what? are we stuck with it? it also appears to have suddenly popped up after everyone got the tcp/ip plugin. lots of info would be greatly appreciated as i have been using spybot for 5 years now and never had a problem like this until now. please somehow help us out.

Hello.

Please see this sticky topic and see if it pertains to your question: ßTCP/IP Settings plugin (http://forums.spybot.info/showthread.php?t=14547)

Cheers.

[tashi]

My solution was taken from other forum and thats why they deleted.

Actually it was edited out because you were posting malware removal instructions, and we are quite clear in our policy here:
http://forums.spybot.info/showpost.php?p=16905&postcount=2

This of course does not affect those of you who wish to post advice to other members in the Spybot-S&D forum regarding Spybot issues; only malware removal and procedures.

Also here: http://forums.spybot.info/showthread.php?t=288

Going it alone and following advice and fixes specifically given to another member is risky, your symptoms may only appear to be similar.

Some of our members query the 2007-06-06 ßTCP/IP Settings plugin (http://forums.spybot.info/showthread.php?t=14547) Following your advice they might proceed to use unnecessary malware removal fixes.

Anyone needing help with an actual infection see: "BEFORE you POST"(READ this Procedure before Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)

Best regards.

[magick]

well im running the latest definitions/updates and each time after zlob.dnschange is scanned and then removed it reappears after rebooting the machine.

[md usa spybot fan]

magick:

Consider following tashi (http://forums.spybot.info/member.php?u=7)'s suggestion posted immediate above your post:




Anyone needing help with an actual infection see: "BEFORE you POST"(READ this Procedure before Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)
Then post in the Malware Removal (http://forums.spybot.info/forumdisplay.php?f=22) forum.

[Patrick K]

Spybot kept finding ZLOB.DNSChanger on my computer. No matter how many times I ran Spybot it kept coming back.

After racking my brain, I was ready to purchase a program that said it could remove it.

Then I thought about it. I went to My Computer to Add/Remove programs and found a program called XXX tracker. I removed the program then deleted my recycle bin and restarted my computer.

When I ran Spybot again the spyware was gone. It was that simple.

Try it. Remove any unknown programs.

It worked for me.