Check If Your PC Infected With DNS Changer Malware



Just read this article at media website INTERAKSYON  that thousands of PC systems in the Philippines infected with the DNS Changer Malware could stand to lose internet access. According to latest data from the DNS Changer Working Group (DCWG), a multi-sectoral ad hoc group of subject matter experts in security and DNS monitoring, some 1,286 unique IP addresses discovered to be infected with the malware were coming from the Philippines.

The DNSChanger malware was discovered last year to be re-routing Internet traffic of infected PCs to servers of a group of Internet hackers, which allows them to display advertisements or spread malware to more users.

Once infected, the Domain Name Settings (DNS) of an infested computer will be changed to that of the hackers’ servers. Reports said systems have started to become infected when they visited similarly infected websites, “or downloaded particular software to view videos online,” according to technology news site CNet.


1. Click Start
2. Open the Command Window
3. (For Windows 7) Type cmd at the search bar
4. (For Windows XP) Click Run, then type cmd at the bar
5. Type ipconfig /all
6. Search for the DNS Servers section

Mac OS X
1. Click the Apple icon an the top left of the screen
2. Select System Preferences
3. Locate the “Network” icon
4. Read the “DNS Server” line

If the DNS servers are pointed at any of the following addresses, then it means the system is infected:

• through
• through
• through
• through
• through
• through

Mine fortunately turned out uninfected:

Okay so that was a good exercise in DOS operating system which I sorely missed. To play games before I literally had to fiddle with DOS settings.

Sorry for putting you through that exercise..

THE EASIEST WAY TO CHECK please go to the following websites:




Share this blog to your friends and hopefully none are infected.



6 thoughts on “Check If Your PC Infected With DNS Changer Malware

  1. Maybe the dns-change malware also has a server that gives a fake copy of this page which is similar in every respect except that it presents to the browser a list of IP addresses different from the one you originally posted?

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s