Hacking.BaBa

DNSChanger Trojan Still Prevalent In 350K Computers

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: -webkit-auto;"><span style="color: #333333; font-family: Georgia, Times, serif;"></span><br /><div></div><span style="color: #333333; font-family: Georgia, Times, serif;"><div><h3 style="text-align: left;"> <span style="font-size: 15px; line-height: 24px;">Over Ten Percent of Fortune 500 Still Infected by DNSChanger</span></h3><div><span style="font-size: 15px; line-height: 24px;">Google is embarking on an effort to notify Internet users if their computers or home routers are still infected with the DNSChanger Trojan, a piece of sophisticated malware that has compromised an estimated 500,000 systems. The outreach campaign comes a little more than a month ahead of July 9, the date on which the FBI is set to take all computers corrupted with the malware offline.</span></div></div><div><span style="font-size: 15px; line-height: 24px;">The FBI ended a major online DNS threat last year, but the arrest of the criminals, and killing the servers would have left millions without internet service, so the servers were replaced. Here’s how to find out if you could lose your internet connection July 9th.</span></div><div><span style="font-size: 15px; line-height: 24px;">The trojan is usually a small file (about 1.5 kilobytes) that is designed to change the 'NameServer' Registry key value to a custom IP address. This IP address is usually encrypted in the body of a trojan. As a result of this change a victim's computer will contact the newly assigned DNS server to resolve names of different webservers.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlNswN0OaBoRE8mXe1OPjbWPiBF2QP5wNpw6bvj10td-RNSur3B3_p4KITG7KOdkouEDvaVaNL2HPCd7W1Y6wdA0LPp0NkiiTopGPrXitqJbvtZVS9WeA6rdXse2X1fM333nqx3Ao0hyaD/s1600/342515-internet-cut-off.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlNswN0OaBoRE8mXe1OPjbWPiBF2QP5wNpw6bvj10td-RNSur3B3_p4KITG7KOdkouEDvaVaNL2HPCd7W1Y6wdA0LPp0NkiiTopGPrXitqJbvtZVS9WeA6rdXse2X1fM333nqx3Ao0hyaD/s1600/342515-internet-cut-off.jpg" /></a></div><div style="font-size: 15px; line-height: 24px;"><br /></div></span></div><div><strong style="border: 0px; font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Variant</strong><span style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px;"> </span><br /><br /><variant style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px;"><em style="background-color: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Trojan.Win32.DNSChanger.al </em><br style="clear: both;" />Lately we got a few samples of this trojan that were named 'PayPal-2.5.200-MSWin32-x86-2005.exe'. This trojan was programmed to change the DNS server name of a victim's computer to 193.227.227.218 address. <br style="clear: both;" /><br style="clear: both;" />The Registry key that is affected by this trojan is: </variant><br /><div id="articles" style="border: 0px; font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin: 8px 0px 16px; outline: 0px; padding: 0px; vertical-align: baseline;"><ul style="background-color: transparent; border: 0px; line-height: 1.1em; list-style: none; margin: 0px 8px -8px; outline: 0px; padding: 0px; vertical-align: baseline;"><li style="background-color: transparent; background-image: url(http://www.f-secure.com/export/system/modules/com.fsecure.frontend.newbrand/resources/css/_ui/images/ico/li.png); background-position: 0% 0.5em; background-repeat: no-repeat no-repeat; border: 0px; float: none; list-style: none outside; margin: 0px 16px 2px 0px; outline: 0px; padding: 2px 0px 2px 0.8em; vertical-align: baseline;"> [HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces] <br style="clear: both;" />  "NameServer"</li></ul></div><div style="border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><br /><b style="background-color: transparent; border: 0px; font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Registry Modifications </b><br /><span style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 15px;">Creates these keys:</span><br /><br /><div id="articles" style="background-color: transparent; border: 0px; margin: 8px 0px 16px; outline: 0px; padding: 0px; vertical-align: baseline;"><ul style="background-color: transparent; border: 0px; font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 1.1em; list-style: none; margin: 0px 8px -8px; outline: 0px; padding: 0px; vertical-align: baseline;"><li style="background-color: transparent; background-image: url(http://www.f-secure.com/export/system/modules/com.fsecure.frontend.newbrand/resources/css/_ui/images/ico/li.png); background-position: 0% 0.5em; background-repeat: no-repeat no-repeat; border: 0px; float: none; list-style: none outside; margin: 0px 16px 2px 0px; outline: 0px; padding: 2px 0px 2px 0.8em; vertical-align: baseline;"> HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random} <br style="clear: both;" />DhcpNameServer = 85.255.xx.xxx,85.255.xxx.xxx</li><li style="background-color: transparent; background-image: url(http://www.f-secure.com/export/system/modules/com.fsecure.frontend.newbrand/resources/css/_ui/images/ico/li.png); background-position: 0% 0.5em; background-repeat: no-repeat no-repeat; border: 0px; float: none; list-style: none outside; margin: 0px 16px 2px 0px; outline: 0px; padding: 2px 0px 2px 0.8em; vertical-align: baseline;">HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{random} <br style="clear: both;" />NameServer = 85.255.xxx.133,85.255.xxx.xxx</li><li style="background-color: transparent; background-image: url(http://www.f-secure.com/export/system/modules/com.fsecure.frontend.newbrand/resources/css/_ui/images/ico/li.png); background-position: 0% 0.5em; background-repeat: no-repeat no-repeat; border: 0px; float: none; list-style: none outside; margin: 0px 16px 2px 0px; outline: 0px; padding: 2px 0px 2px 0.8em; vertical-align: baseline;">HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ <br style="clear: both;" />DhcpNameServer = 85.255.xxx.xxx,85.255.xxx.xxx</li><li style="background-color: transparent; background-image: url(http://www.f-secure.com/export/system/modules/com.fsecure.frontend.newbrand/resources/css/_ui/images/ico/li.png); background-position: 0% 0.5em; background-repeat: no-repeat no-repeat; border: 0px; float: none; list-style: none outside; margin: 0px 16px 2px 0px; outline: 0px; padding: 2px 0px 2px 0.8em; vertical-align: baseline;">HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ <br style="clear: both;" />NameServer = 85.255.xxx.xxx,85.255.xxx.xxx</li></ul><div style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px;"><span style="line-height: 13px;"><br /></span></div><div style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px;"><span style="line-height: 13px;"><b><br /></b></span></div><h3 style="text-align: left;"> <span style="background-color: transparent; font-size: 14px; line-height: 13px;"><span style="font-family: Arial, Verdana, Helvetica, sans-serif;">Manual</span></span><span style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px; line-height: 13px;"><b> Way to Remove it:</b></span></h3><div style="font-family: Arial, Verdana, Helvetica, sans-serif; font-size: 12px;"><div id="yui_3_5_1_20_1340998964117_516" style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; margin-top: 11px; padding: 0px; text-align: -webkit-auto;">If a manual check of the DNS nameserver system is desired, then here are the steps for Windows XP and newer:</div><ul class="releaseul" id="yui_3_5_1_20_1340998964117_470" style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; list-style: none; margin: 0px; padding: 0px; text-align: -webkit-auto;"><li id="yui_3_5_1_20_1340998964117_469" style="list-style: disc inside; margin: 0px; padding: 0px;"><div style="padding: 0px;"></div><div id="yui_3_5_1_20_1340998964117_468" style="margin-top: 11px; padding: 0px;">    Click on: Start-->run-->then type “cmd” in the box, no quotes.</div></li><div style="margin-top: 11px; padding: 0px;"></div><div style="margin-top: 11px; padding: 0px;"></div><li id="yui_3_5_1_20_1340998964117_481" style="list-style: disc inside; margin: 0px; padding: 0px;">    Type in the command window, “ipconfig/all” again no quotes.</li><div style="margin-top: 11px; padding: 0px;"></div><div style="margin-top: 11px; padding: 0px;"></div><li id="yui_3_5_1_20_1340998964117_479" style="list-style: disc inside; margin: 0px; padding: 0px;">    Scroll down through all the other data and find “DNS servers.” This will either look like this: 192.168.2.1, if it looks like this: fec0:0:0:ffff::1%1, then your router uses IPv6 and you can’t manually check the connection. Write the addresses of the nameservers you are using down.</li><div style="margin-top: 11px; padding: 0px;"></div><div style="margin-top: 11px; padding: 0px;"></div><li id="yui_3_5_1_20_1340998964117_472" style="list-style: disc inside; margin: 0px; padding: 0px;">    Go to: <a href="https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS" id="yui_3_5_1_20_1340998964117_478" style="color: #5d4370; text-decoration: none;">https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS</a>, and enter your DNS server addresses into the checker box and hit the “Check Your DNS” button. Your results will only take a few seconds.</li></ul><div style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; margin-top: 11px; padding: 0px; text-align: -webkit-auto;"></div><div style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; margin-top: 11px; padding: 0px; text-align: -webkit-auto;"></div><div id="yui_3_5_1_20_1340998964117_476" style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; margin-top: 11px; padding: 0px; text-align: -webkit-auto;">If You Have DNSChanger In Your System</div><div id="yui_3_5_1_20_1340998964117_476" style="font-family: Georgia, Times, 'Times New Roman', serif; font-size: 14px; line-height: 22px; margin-top: 11px; padding: 0px; text-align: -webkit-auto;">That all :)</div></div></div></div></div></div>