Do you know someone who can’t navigate and instead of the well known websites receives errors like
- “Unable to resolve the DNS address”
- “Server not found”
- “The webpage is not available” ?
He might be infected with the DNSChanger malware and since July 9th 2012, the temporary servers which were set up by the FBI aren’t online anymore. This has as a direct effect the fact that his computer can’t do any DNS requests anymore. This is why the computer is no longer able to locate any webpage.
Fortunately, if this is the case, there are solutions to fix the problem very easy.
First of all, you need to make sure that the Internet connection to the ISP works properly.
For this, it is enough to make a ping to a known IP address. It is important to not make the ping to a domain name (e.g.: google.com) because it will surely fail if the computer is infected with the DNSChanger malware.
>ping 62.146.210.52
Pinging 62.146.210.52 with 32 bytes of data:
Reply from 62.146.210.52: bytes=32 time=39ms TTL=53
Reply from 62.146.210.52: bytes=32 time=40ms TTL=53
Reply from 62.146.210.52: bytes=32 time=38ms TTL=53
Reply from 62.146.210.52: bytes=32 time=39ms TTL=53
Ping statistics for 62.146.210.52:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 38ms, Maximum = 40ms, Average = 39ms
The IP address 62.146.210.52 is one of the IPs which are returned when you run a “nslookup avira.com”.
If you get results similar to those above, then the connection to the ISP works, but the DNS server doesn’t. This is a clear sign of the infection.
Here are the necessary steps to see if the computer was infected with the malware and how to fix the problem.
As a summary of the above article, you must download and save on a USB stick the Avira DNS-Repair tool and execute it on the affected computer in order to revert to the default settings of Windows. As an alternative, just write in your browser the address of Avira’s webserver: http://62.146.210.52/de/support-for-home-knowledgebase-detail/kbid/1199 and download the tool from there. Please be aware that once you connect to the Internet in the usual way, there is the danger to get other malware or to allow existing malware to update themselves. We strongly suggest to use the first solution, without any Internet connection.
You can download the tool free of charge from the Avira Support’s Knowledge Base website in German and in English.
After the DNS problem is solved, we suggest to make a full system scan using the Rescue System .
Sorin Mustaca
Leave a reply
