Results 1 to 10 of 10

Thread: Zlob.DNSChanger How to get rid of

  1. #1
    Junior Member
    Join Date
    Oct 2008
    Posts
    1

    Default Zlob.DNSChanger How to get rid of

    How do I get rid of Zlob.DNSChanger? When I run Spybot it finds it and removes but it always comes back. I have heard it is a virus. I am running Vista. Please let me know. Thank you

  2. #2
    Junior Member
    Join Date
    Oct 2008
    Location
    The Netherlands
    Posts
    14

    Default

    have the same problem I am running vista and I couldnt find much info in the net.help will be greatly appreciate!

  3. #3
    Senior Member
    Join Date
    Oct 2005
    Location
    Los Angeles
    Posts
    219

    Default

    go down to the Malware Removal Forum
    read the stickie before you post
    follow instructions exactly
    do NOT reply to your first post

  4. #4
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,491

    Default

    Hello smithdr107 and metto_,

    Please do the following,


    • Open SpyBot
    • Check for problems, do not 'fix' any items found
    • Switch Spybot S&D to advanced mode
    • Navigate to tools - view report
    • Click "view report"
    • Click "export" to save the report to a text file and paste the top of the report showing the detection, and Spybot version, here please.


    Cheers.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  5. #5
    Senior Member
    Join Date
    Oct 2005
    Location
    Los Angeles
    Posts
    219

    Default

    Do what Tashi Says
    good luck to both of you

  6. #6
    Junior Member
    Join Date
    Oct 2008
    Location
    The Netherlands
    Posts
    14

    Default

    Hi Tashi 10x for the quick response I hope with ur help to get rid of the Zlob

    --- Search result list ---
    Hint of the Day: Click the bar at the right of this to see more information! ()


    Zlob.DNSChanger: [SBI $041D1396] TCP/IP Settings #1 (Undefined) (Registry change, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{836BA180-D854-471B-BA7B-51351C35DFF1}\NameServer=208.67.220.220,208.67.222.222

    Zlob.DNSChanger: [SBI $041D1396] TCP/IP Settings #2 (Undefined) (Registry change, nothing done)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{836BA180-D854-471B-BA7B-51351C35DFF1}\DhcpNameServer=208.67.220.220,208.67.222.222


    --- Spybot - Search & Destroy version: 1.6.0 (build: 20080707) ---

  7. #7
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,491

    Default

    Hello metto_

    Looks like a wareout infection, some of the tools helpers use do not work in Vista.

    However for an analyst to take a look at the system, please follow the procedure in this link:
    "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

    Then start your own thread in the Malware Removal Forum where a helper will advise you when available.

    Regards.
    Last edited by tashi; 2008-10-01 at 17:54. Reason: clarify
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

  8. #8
    Esteemed Member
    Join Date
    Oct 2005
    Posts
    554

    Default

    Tashi,

    Those DNS entries looked familiar to me, so I checked and they are simply the OpenDNS servers.

    Here's another similar thread in the Archives originally handled by steamwiz.

    http://forums.spybot.info/showthread.php?t=16215

    I'm thinking this may be a transient false positive, though you may want to get an HJT log first to confirm and help the Team debug.

    Bitman

  9. #9
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Spybot sets those entries also when attempting to remove zlob.dnschanger, too. This is the most likely case here.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  10. #10

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •