DNSChanger Malware

Hackers have learned that if they be able to manipulate a user’s DNS servers settings, they can manipulate what websites the user connects to on the Internet.  By controlling DNS, a hacker be able to obtain an unsuspecting consumer to visit a fraudulent website or to interfere through that user’s online web browsing.  One technique criminals accomplish this is by means of infecting computer systems with a class of malicious software program (malware) called DNSChanger. The hacker utilizes the malware to alter the user’s DNS server settings to change the ISP’s good DNS with rogue DNS servers operated by the hacker To aid victims affected by the DNSChanger malware, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to set up and maintain temporary clean DNS servers. This solution is temporary, providing extra time for victims to fix affected computer systems and reinstate their standard DNS settings.

What Should I Do?

The FBI’s DNS Changer Working Group can detect the malware by running a DNS check. Check if your computer is infected by visiting the following site

If your PC or SOHO router has been affected by DNSChanger we recommend that you have it check by a qualified computer professional.  It is essential to verify the DNS server settings on the computer.  If the computer is joined to a WI-FI or router, the settings on those equipments should be checked as well Please contact Sarceno Network Consulting if you require further help.

Users may lose online access on July 9, 2012.

The FBI took down the servers of international hackers operating out of Estonia. The hackers had by now effectively downloaded malware onto more than half a million computer systems, turning off virus updates and redirecting users to fake internet sites. If the servers had simply been shut down, the victims’ computer systems would no longer be able to access the world wide web. Instead, the FBI set up clean servers to replace the ones that were running the scam, and victims have been redirected to those clean servers ever since, usually without any knowledge they’d been infected. Originally the rescue servers have been active until March, but a court ruling extended the program until July 9th.  At that time the clean servers will be turned off and anybody who is still infected with the malware will lose their internet access.  For more information visit

• Learn about DNSChanger malware and how it can affect your computer
• Check your computer’s DNS settings
• Register as a victim of the DNSChanger malware