DNS changer

DNS changer is malware that infects a computer’s system and, in some cases, the router. In general, DNS (Domain Name System) converts domain names into the numerical Internet protocol (a.k.a. IP) addresses. This allows a user’s computer to connect to a desirable website. Without DNS and DNS Servers, it would be impossible to use the Internet.

The creators of DNS changer can control a targeted computer’s DNS server and redirect an Internet browser to suspicious and fraudulent websites. Good DNS servers are changes into band servers controlled by the attackers. Because of the presence of this infection, which usually disables the computer’s antivirus software, the Internet connection might be lost. Moreover, the infection may also try to access other devices of the victim’s home office network. It was found that CNS changer malware uses default login usernames and passwords to access the devices so that more machines are affected. The researches of DNS changer imply that when a victimized computer’s systems might be infected with other malware.

To check whether you are infected with the malware, it is advisable to open cmd.exe, enter “ipconfig /all” and look for the entry “DNS Servers”. If your IP address of DNS server matches with the ranges provided below, it means that the computer is infected.

85.255.112.0 through 85.255.127.255
67.210.0.0 through 67.210.15.255
93.188.160.0 through 93.188.167.255
77.67.83.0 through 77.67.83.255
213.109.64.0 through 213.109.79.255
64.28.176.0 through 64.28.191.255

Private addresses usually fall in one of these three ranges:

192.168.0.0 to 192.168.255.255
172.16.0.0 to 172.31.255.255
10.0.0.0 to 10.255.255.255

Concerning SOHO (Small office/home office) networks, if the routers in use have the default usernames and passwords, the malware might infects those routers as well. If you compare the configuration of the SOHO router with the servers provided above and find that they do not match, a computer on the network might be infected with DNS Changer.

Moreover, to learn whether you are infected or not, you can visit http://dns-ok.gov.au/. If the system is clean, you will see a message saying “You do not appear to be affected by DNSChanger.”

When an infection of this type affects the system, is highly advisable to remove the infection. The malfunctioning of the system does not fascine anyone; hence, do not delete and remove DNS Changer from your computer as soon as you. Note that you should use a reliable and powerful tool; otherwise, there might be more serious problems related to malware.