What's the DNSChanger malware and how to clean it?

What’s the DNSChanger malware and how to clean it?

PLDT and Smart are asking their subscribers to check if their respective computers are infected by a malware called DNSChanger before July 9, 2012 as it may have long-term effects that may render your computer useless for browsing the web.

The DNSChanger belongs to the Zlob Trojan virus family which caused quite a stir in the US last year. The FBI has taken actions against it announced that they’ve found the source of the virus and shut down the operation November of last year.

Another DNS server were then setup to replace the malicious server for a certain period of time to give enough leeway for users to clean up their infected computer/s. But by July 9, the authorities will be pulling the cord on the temp servers and users with computers which are still infected will not be able to surf the net.

To check if your computer is infected follow these simple steps courtesy of PLDT-Smart:
Manual Checking/Detection


Click Start
1. Open the Command Window
2. (For Windows 7) Type cmd at the search bar
3. (For Windows XP) Click Run, then type cmd at the bar
4. Type ipconfig /all
5. Search for the DNS Servers section

Mac OS X


1. Click the Apple icon an the top left of the screen
2. Select System Preferences
3. Locate the “Network” icon
4. Read the “DNS Server” line

Alternatively, subscribers may also visit the following sites to their system checked automatically.

http:// dnschanger.detect.my

Ensure that the DNS Servers are not within the following range of Internet Protocols (IPs):

* through
* through
* through
* through
* through
* through

If the DNSChanger is detected, users may then use any of the following software to clean the infection:

• Hitman Pro (32bit and 64bit versions)
• Kaspersky Labs TDSSKiller
• McAfee Stinger
• Microsoft Windows Defender Offline
• Microsoft Safety Scanner
• Norton Power Eraser
• Trend Micro Housecall
• MacScan
• Avira’s DNS Repair-Tool

Even though I’m pretty sure that my PC is not infected, I still tried to do the manual detection as well as the automatic one (http://www.dns-ok.us/) just to be safe. We suggest you do it as well. Be sure to check your PC before the said date to avoid future inconvenience. It pays to be safe.

This article was written by Ronnie Bulaong, a special features contributor and correspondent for YugaTech. Follow him on Twitter @turonbulaong.

You may also like...

5 Responses

  1. kouya1304 says:

    Im doing this everyday just to make sure :D

  2. JM says:

    There are tons of DNS changers currently in the wild, and I think the one used in the cybercriminal operation that got busted late last year is a different one. :)

    Infection can also be verified here: https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS

    Btw, Trojans are different from viruses :) Trojans do not have the capability to spread by themselves; viruses do.

  3. balasubas says:

    So when did PLDT start asking their subscribers about this? I am a PLDT user but I did not get any email or phone call from them, although I’m pretty sure I’m free from this virus.

  4. Maria says:

    I’ve visited both sites mentioned on the article and both says my computer is OK. Thanks for letting us know about this.

  5. Nice answers in return of this query with real arguments and explaining all about

Leave a Reply

Your email address will not be published. Required fields are marked *