Thursday, October 13, 2011

Get rid of TR/DNSChanger.VJ.2 and restore safe DNS settings in one move

TR/DNSChanger.VJ.2 is instructed to reset DNS settings of infected PC. Any PC with the above program in its memory is deemed to be infected, for it is classified as a trojan by prevailing method of its distribution. Combination of letters at the very beginning of the trojan name (TR) encodes its propagation method – trojan download. Next letters between the slash up to the dot betrays payload of the trojan, DNS changing. Last letters refer to the version of the infection. That is, the trojan in question is a mutating parasite. This particular modification is known to be capable of establishing and maintaining lasting connections to several remote servers and might mutate into newer versions while staying at particular PC.
Remove TR/DNSChanger.VJ.2 and restore safe DNS settings in one move – this option is available with free scanner (DNSChangerVJ.2 remover): click here to start the download.




Manual removal guide:
Delete infected files:
%ProgramFiles%\PopinMV
%ProgramFiles%\PopinMV\PopinMVUpdate
%ProgramFiles%\Gen:Variant.Buzy.4104
Delete infected registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
    Path = "%ProgramFiles%\PopinMV\PopinMVUpdate"
    (Default) = "%ProgramFiles%\PopinMV\PopinMVUpdate\TR/DNSChanger.VJ.2"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    PopinMVUpdate = "%ProgramFiles%\TR/DNSChanger.VJ.2"

No comments: