기술 문서

How can I Identify a system infected with the DNSChanger Trojan?


Article Summary: This article will assist in identifying a system infected with the DNSChanger Trojan and how to remove it.


If you get an Internet connectivity issue where normal troubleshooting has no effect, the cause may be the DNSChanger Trojan.

Discussion and Diagnosis

If a system still has active internet connectivity the system can be checked by logging on to the following web site: http://www.dns-ok.us/ if the webpage loads with a GREEN background the system is not infected, if it had a RED background it MAY be infected and running a removal tool should confirm this (Some router configurations may cause a false positive.) If you have a system that you think may have this malware, the using an offline malware scanner should resolve the issue. Infected systems can be identified by DNS IP addresses in the list below:

If ipconfig /all lists DNS routed via IP addresses in this range, the system is infected.

Removal and Prevention

Here are a few of the available offline malware scanning products that can be used to resolve the problem:

Windows Defender Offline: http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline
McAfee Stinger: http://www.mcafee.com/us/downloads/free-tools/stinger.aspx
TDSS Killer: http://support.kaspersky.com/faq/?qid=208283363

To remove the malware, the user will have to download and create bootable media on a NON-INFECTED system, then boot the effected system to the removal media to remove the malware. (I have used the Windows Defender Offline tool and found it to be user friendly and creates either USB or burnable boot media for malware removal.) We can provide diagnosis and removal information as Best Effort support, however, actual malware removal is not a Dell supported issue unless removed under a fee based support scenario. Once infection is removed, re-infection can be prevented by most any up to date antivirus application.

REFERENCES: http://www.dcwg.org/




Quick Tips content is self-published by the Dell Support Professionals who resolve issues daily. In order to achieve a speedy publication, Quick Tips may represent only partial solutions or work-arounds that are still in development or pending further proof of successfully resolving an issue. As such Quick Tips have not been reviewed, validated or approved by Dell and should be used with appropriate caution. Dell shall not be liable for any loss, including but not limited to loss of data, loss of profit or loss of revenue, which customers may incur by following any procedure or advice set out in the Quick Tips.

문서 ID: SLN123314

최종 수정일: 08/17/2018 04:41 AM


이 문서 평가하기

정확함
유용함
이해하기 쉬운
이 문서가 도움이 되셨나요?
지원 미지원
피드백을 보내 주십시오.
의견에는 <>()\와 같은 특수 문자를 사용할 수 없습니다.
죄송합니다. 현재 피드백 시스템은 사용하실 수 없습니다. 잠시 후에 다시 시도하십시오.

피드백을 보내주셔서 감사합니다.