Home Malware Programs Trojans TROJ_DNSCHANG.XT

TROJ_DNSCHANG.XT

Posted: May 3, 2010

TROJ_DNSCHANG.XT is a malicious Trojan that may be downloaded from corrupt websites. TROJ_DNSCHANG.XT connects to the Internet and downloads malicious files for the affected sytem to be monitored by hackers. The hackers behind TROJ_DNSCHANG.XT are most likely involved in identity theft and other cybercrime. Once detected, TROJ_DNSCHANG.XT should be removed immediately using a reliable malware remover.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Program Files%\Common Files\{random filename}.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\HKEY..\..\..\..{RegistryKeys}(Default)={Ethernet Adapter}DhcpEnabled=1DnsFile={BLOCKED}.{BLOCKED}.97.20 {BLOCKED}.{BLOCKED}.97.21DnsRecords={hex values}NoModify=1NoRepair=1Size=UninstallString=%Program Files%\Common Files{malware filename}.exeUninstall\DnsUpdater1Uninstall\DnsUpdater1 DisplayName=DNS Changer (remove only)Uninstall\DnsUpdater1\if1
Loading...