# MA-308.042012: MyCERT Alert - DNSChanger Malware

**Date:** 20 Apr 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-308.042012  
**Advisory ID:** MA-308.042012

---

**1.0 Introduction**
MyCERT has been receiving reports from trusted sources since 14th November 2011 regarding the propagation of a malware called DNSChanger. MyCERT had notified Internet Service Providers and network owners in Malaysia since November 2011 and at this point there are roughly 1000 – 1500 infected IPs.
In November 2011, the FBI closed down a ring of cyber criminals who are believed to have been responsible for the worldwide spread of DNSChanger. An estimated four million users were affected worldwide. The FBI worked with the Internet Systems Consortium (ISC) to set up and operate a correct, temporary DNS solution so that these users would not lose their internet access when the malicious DNS servers were taken down.
This temporary DNS solution gives users infected with DNSChanger the opportunity to remove the infection before the temporary solution is switched off on 9 July 2012. After this date, it is likely that users infected by DNSChanger will not be able to connect to the internet.
**2.0 What is DNSChanger?**
DNSChanger is a type of malware that infect computers with the purpose of diverting traffic to potentially illegal and malicious websites. The malware modifies the infected computer's DNS server setting replacing it with DNS server belonging to the attackers.
By doing this, the attackers can trick unsuspecting users to visit sites owned by them and in the process carry out malicious activities such as stealing the credentials of the users. It is also possible that the computers be infected by other malware.
**3.0 Detection and Removal**
It is very critical that infected computers must be detected and cleaned without delays to ensure Internet connectivity and to prevent unwanted incidents.
By working closely with the DNSChanger Working Group, CyberSecurity Malaysia has put up a web page for users to check if their computers have been infected with DNSChanger. The URL is as follows:
- <http://dnschanger.detect.my>
Most anti-virus softwares are able to detect and remove this malware. We have also developed a removal tool which can be downloaded here:
- [https://www.mycert.org.my/portal/articles-content?menu=410dc9ed-f999-4576-b9fc-d474db1bae0c&id=06fab253-9555-4692-a330-1d4b35a2cf34](https://www.mycert.org.my/portal/articles-content?menu=410dc9ed-f999-4576-b9fc-d474db1bae0c&id=06fab253-9555-4692-a330-1d4b35a2cf34
)
**4.0 Preventive Measures**
Some of the preventive measures that users can take against the DNSChanger and other malware infection are:
- Always update their computers with latest patches and security fixes.
- Install an Anti-virus software and make sure it has the latest signatures.
- Do not click on unsolicited web links and attachments.
- Make sure the Internet browsers are up to date with the latest patches.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT   to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <http://www.dcwg.org>
- <http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf>
- <http://www.us-cert.gov/current/archive/2012/02/29/archive.html#operation_ghost_click_malware>
- <http://www.f-secure.com/v-descs/dnschang.shtml>
- <http://reviews.cnet.com/8301-13727_7-57322316-263/fbi-tackles-dnschanger-malware-scam/>