Printable View
I have heard that there has been DNS malware all over the web and FBI is going to shutdown the DNS servers that might have got affected by it. So I just wanted to know what exactly this DNS malware is. Is there any way by which I can check whether my system has got affected or not?? it was said that FBI will be shutting down the DNS servers on 9th April but I don’t think they did?? Ts this just a rumor or they have delayed the shutdown?? Any ideas??
I don’t think this is any kind of rumor and one should take it seriously. DNSChanger Malware changes the user’s DNS server settings to bad DNS servers or rogue DNS server which are said to be operated by Criminals. Recently FBI has found a network of rogue DNS servers and they have decided to disable it and fix it. So if anyone’s system is affected with DNSChanger Malware then they will be losing access to the Internet for some period of time until it gets fixed. There are more than 1 million computers that have been found to be infected, so there are possibilities of your system being affected amongst them. Anyways one can check if their system has been infected with DNSChanger or not and can eliminate it before FBI shut down their DNS servers. It was said that process will get carried out on 9th of july but I think it has got postponed. For checking out if your system is infected by the DNSChanger Malware you can refer to the below steps:
Checking DNS servers:
Windows xp/ windows 7
For checking out your DNS servers go to start>run> type “cmd” without the quotes and chit enter.
When you get the Command Prompt application opened then type “”ipconfig /allcompartments /all” without the quotes and hit enter.
Now you will get a block of text like the below:
Mac os x:
If you are using mc system then Open Apple menu>System Preferences>Click on Network icon>Advanced Settings and check out the DNS Server box.
Once you know your DNS servers visit DNSChanger Check-Up website and check the message that you are getting.If you get a message saying “Your computer appears to be looking up IP addresses correctly!” Then well and good. If you get a message saying your computer has been affected then you can perform the below steps for getting rid of it.
Reinstalling operating system
If you are not willing to reinstall operating system then you can try out rooting DNSChanger rootkit with a free malware removal utility. For that you can use Kaspersky Labs' TDSSKiller, it has been released to find out and destroy the TDSS rootkit malware.
If your system is on network then you will have to check out all PC on the network along with the router's settings. Sources say if any system on a network gets infected tghen there are possibilities of the router's settings to get changed as well. If it is so then you will have to reset the router setting and also cross check it with FBI's IP address database.
Just to inform you about the spread of DNSchanger infection:
US - 69,517
Italy - 26,494
India - 21,302
UK - 19,589
Germany - 18,427
France, 10,454
China - 10,304
Spain - 10,213
Canada - 8,924
Australia - 8,518
There are many more, there are just Top 10 counties infected by Dnschanger malware.
There is another way as well, you can just cross check your computer DNS servers with the ones listed below:
- 85.255.112.0 through 85.255.127.255
- 67.210.0.0 through 67.210.15.255
- 93.188.160.0 through 93.188.167.255
- 77.67.83.0 through 77.67.83.255
- 213.109.64.0 through 213.109.79.255
- 64.28.176.0 through 64.28.191.255
If you find your system to be using any of the rogue DNS servers amongst these then your system might be infected by DNSchanger malware.