Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Germany to shut down DNSChanger Trojan servers

Temporary DNS fix to be shut down after malware network closed

Article comments

German authorities are advising victims of DNSChanger Trojan programs to fix their computers' Domain Name System settings using a free tool developed by antivirus company Avira, because the servers resolving DNS queries on their behalf will be closed down on March 8.

DNSChanger is a family of Trojans for Windows and Mac OS X whose primary function is to replace the DNS servers defined on the victim's computer with rogue ones operated by the malware's authors.

The DNS is a vital part of the Internet infrastructure and is used to resolve domain names into numerical IP addresses. By controlling DNS responses, the DNSChanger gang was able to redirect victims to rogue websites that distributed fraudulent software or displayed money-generating advertisements.

The DNSChanger operation was shut down by the US Federal Bureau of Investigation in November last year following a two year long investigation. The authorities estimated the number of computers infected with this type of Trojan at 500,000 in the US and over four million worldwide.

The FBI worked with ISPs where the DNSChanger gang hosted its rogue DNS resolvers in order to temporarily convert them into legitimate servers. This decision was taken in order to provide victims with sufficient time to clean their computers without disrupting their Internet access.

On January 11, the German Federal Office for Information Security (BSI) announced that the temporary DNS resolvers put in place to service DNSChanger victims will be permanently shut down on March 8. The government agency worked with antivirus firm Avira to provide affected users with a tool that automatically resets their DNS settings to their default values.

"If your computer was infected at some point in time and it was using one of the DNS servers which are now controlled by FBI, after March 8, it will no longer be able to make any DNS requests through these servers," explained Avira product manager and data security expert Sorin Mustaca. "In layman's terms, you will no longer be able to browse the web, read emails and do everything you usually do on Internet."

The Avira DNS Repair Tool is distributed for free from the company's website, as well as www.dns-ok.de, a website operated by German authorities that can be used to determine if a computer is using one of the temporary DNS servers.

The downside of the tool is that it only works on Windows, and doesn't actually remove the Trojan. Users should first clean their computers with an antivirus program and then use Avira's tool to repair their DNS settings.

"Only the [network] adapters which are detected as manipulated will be changed," Mustaca said. "All others which don't have any signs of being altered by the malware will be left untouched."

Since the tool configures network adapters to automatically detect DNS settings via DHCP, it might not work for all network setups. If using the tool doesn't solve the problem, users should call their ISP and ask what their recommended DNS settings are.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *