Q. What is the DNS Changer Bot?
A. The DNS Changer bot is malware that changes your DNS server information on your computer, so that the hackers behind it can direct your computer to whatever website they want to. This could mean that you could be directed to the correct site, or even a false version of the website you’re looking for. These false DNS servers will be shut down by the FBI on July 9th, 2012, so please test your computers before then. After July 9th, infected computers will be unable to access the internet properly until the malware is removed.
For more information, please see:
http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf
Q. I received a notification from Atlantic Broadband. Does this mean my computer is infected?
A. No, this does not mean that your machine is definitely infected. We sent this notification to all of our customers to inform you of the malware, as well as to list the steps of how to recognize it and remove it.
Q. I have a Mac, does that mean I’m protected from the Changer Bot?
A. No! This malware can infect Macs just as easily as Windows machines. Please check all of your computers!
Q. I checked my iPhone/iPod/iPad, etc, and the webpage tells me I’m infected. What do I do?
A. Apple has announced that iOS devices (iPhone/iPod/iPad) cannot be infected by this malware. What that message most likely means is that your home router is infected. This would only be the case if you did not change the default user name and password for your router when you initially configured it.
Q. Where can I go to see if I’m infected?
A. You can go to http://www.dns-ok.us/ to see if your machine is infected. You must do this on every computer in the house that has the ability to get on the internet.
Q. I think my router is infected. How can I be sure?
A. You must log into your router and check the DNS servers that it has listed. Below are the recognized infected servers:
85.255.112.0 through 85.255.127.255
67.210.0.0 through 67.210.15.255
93.188.160.0 through 93.188.167.255
77.67.83.0 through 77.67.83.255
213.109.64.0 through 213.109.79.255
64.28.176.0 through 64.28.191.255
If your router shows that it is using any of the listed servers, you will have to change them back the “automatic” or “dhcp” option.
If you are unsure on how to log into your router, check your DNS settings, etc, you can either consult the manual that came with your router (usual on a CD) or you can call your router manufacturer for more assistance. If your route r was provided by Atlantic Broadband, please contact our Technical Support Team at 888-536-9600.
Q. I have determined that my computer is infected. Now what?
A. There are several free removal tools on the internet for use against this malware. Be wary however as there are just as many tools out there claiming that they will fix it, but will just infect you with further malware. Atlantic Broadband suggests you use the following page as a resource to fix this issue, as the tools on it have been certified valid: http://www.dcwg.org/fix/
If you have any further questions, please feel free to contact our Technical Support Team at 1-888-536-9600.