Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Some weeks ago I started having problems with my internet connection, it was extremely slow and suddently some websites (specifically gmail, facebook, youtube and twitter) started failing to connect, while the rest connect normally. Some days after, those same websites started showing me a message in portuguese: "Nova atualização disponível" whenever I tried to connect and a .exe file started downloading ("internet_update.exe" or something like that).

That's when I freaked out! It was definitely a virus or something like that, but it was really weird because I never had a problem like that (I run Linux). So I turned on my old PC (running Windows XP) and it turned out it had the same problem! the same message was showed whenever I tried to connect one of those specific websites, while the rest loaded without problems. Even in my Android smarthphone the same message was showed.

So it was obvious that the problem was not in a particular machine but in the router itself. So I started googling and I found some information, unfortunately I only found some in spanish, so I will make you a short summary:

It is a new banking trojan developed specifically to infect and collect information from Brasilian banks. Apparently now it has expanded to Argentina and Peru.

So how does it work? It spreads through social networks (videos, links, ...) and then it "takes control" of your internet connection by changing the values of your DNSs. More specifically, it changes the Primary DNS to one of this IPs: 108.170.13.38, 66.7.216.122 or 63.143.43.154 and the Secondary DNS to 8.8.8.8, this secondary DNS is actually the Google Public DNS, and it is configured this way so that your internet connection continue working properly and the user does not notice anything.

The important part here is that because no download or install has been made in your machine, no antivirus will notice any change. After your DNSs have been changed, the trojan controls every single website you connect to and this way they steal your bank information.

So after reading about this I accesed to my router and I restored my Primary and Secondary DNSs to their proper values, but one day after I had the same problem again.

This is actually a 50% warning post - 50% help me! post.

So, here comes the question: Is there any possible way to prevent my DNSs of being changed?

share|improve this question

closed as off topic by Tim Brigham, Tom O'Connor, sysadmin1138 Dec 17 '12 at 13:09

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

It definitely sounds like your router has been compromised. Your best best would be to nuke / replace it as once this happens your internal network is vulnerable.

As a workaround don't use DHCP to set your DNS servers but enter them directly onto your workstation.

share|improve this answer
    
I reset the router the first time I corrected the DNSs values, but the problem came back. Sorry, but what do you mean with "enter them directly onto your workstation"? –  juliomalegria Jun 6 '12 at 16:39
    
You can enter static IP and DNS (or just DNS) entries on your computer. I would be more concerned about stopping your router from being tampered with. –  Tim Brigham Jun 6 '12 at 16:41
    
I'm really concerned about stopping my router from being tampered with, but I don't seem to find anyway of doing it. –  juliomalegria Jun 6 '12 at 16:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.