Threat Search: 

ThreatExpert's Statistics for Trojan.DNS_Changer [PC Tools]:

Trojan.DNS_Changer [PC Tools] is also known as:
Threat AliasNumber of Incidents
TROJ_DNSCHAN.XOR [Trend Micro]17
DNSChanger.f [McAfee]16
Trojan.Win32.DNSChanger.in [Kaspersky Lab]15
Trojan.Flush.G [Symantec]5
DNSChanger.a [McAfee]4
Trojan:Win32/Alureon.A [Microsoft]3
DNSChanger.d [McAfee]2
Mal/Behav-010, Mal/TibsPk-A, Mal/Packer, Mal/Behav-027, Mal/Behav-155 [Sophos]2
TROJ_Generic [Trend Micro]2
Trojan.Flush.A [Symantec]2
Trojan.Win32.DNSChanger [Ikarus]2
Trojan.Win32.DNSChanger.ih [Kaspersky Lab]2
Trojan.Zlob [Symantec]2
Trojan-Dropper.Agent [Ikarus]2
DNSChanger.gen [McAfee]1
DNSChanger.jf [McAfee]1
Puper.gen.d [McAfee]1
Troj/DNSBust-C [Sophos]1
Troj/DNSBust-J [Sophos]1
TROJ_DNSCHAN.ADD [Trend Micro]1
TROJ_DNSCHAN.E [Trend Micro]1
TROJ_ZLOB.DNQ [Trend Micro]1
TROJ_ZLOB.HU [Trend Micro]1
Trojan Horse [Symantec]1
Trojan.Adclicker [Symantec]1
Trojan.Flush.K [Symantec]1
Trojan.Win32.DNSChanger.ak [Kaspersky Lab]1
Trojan.Win32.DNSChanger.as [Kaspersky Lab]1
Trojan.Win32.DNSChanger.bj [Kaspersky Lab]1
Trojan.Win32.DNSChanger.bk [Kaspersky Lab]1
Trojan.Win32.DNSChanger.hm [Kaspersky Lab]1
Trojan.Win32.DNSChanger.ik [Kaspersky Lab]1
Trojan.Win32.DNSChanger.jf [Kaspersky Lab]1
Trojan:Win32/Dnschanger.AA [Microsoft]1
Win-Trojan/Dnschanger.28160.BU [AhnLab]1

Trojan.DNS_Changer [PC Tools] is known to be created as:
%ProgramFiles%\christmasporn\uninstall.exe
%ProgramFiles%\videokey\uninstall.exe
%System%\hgqhp.exe
%System%\kdfht.exe
%System%\kdhgy.exe
%System%\kdhuo.exe
%System%\kdler.exe
%System%\kdmxj.exe
%System%\kdpoe.exe
%System%\kdpwk.exe
%System%\kdqvw.exe
%System%\kdwro.exe
%System%\kdxtz.exe
%System%\kdyyp.exe
%System%\kdzfh.exe
%Temp%\nsb3.tmp\dcryptdll.dll
%Temp%\nsb5.tmp\dcryptdll.dll
%Temp%\nse4.tmp\dcryptdll.dll
%Temp%\nsg5.tmp\dcryptdll.dll
%Temp%\nsi3.tmp\dcryptdll.dll
%Temp%\nsk2.tmp\dcryptdll.dll
%Temp%\nsn3.tmp\dcryptdll.dll
%Temp%\nsn4.tmp\dcryptdll.dll
%Temp%\nsq4.tmp\dcryptdll.dll
%Temp%\nst3.tmp\dcryptdll.dll
%Temp%\nst4.tmp\dcryptdll.dll
%Temp%\nsv4.tmp\dcryptdll.dll
%Temp%\nsz3.tmp\dcryptdll.dll
Notes:
  • %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
  • %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
  • %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).