Good Morning!

We have recently begun seeing reports of suspicious settings in DNS (none from our client base...yet). Clients affected exhibit the following behaviour:

• Sudden slowdown of internet browsing
• Domain not found at logon
• "Unable to locate domain" errors in the event logs

Investigation of the matter reveals only that the DNS settings have been changed to show two addresses:

93.188.161.198 and 93.188.161.15

Each of these addresses originates in Ukraine (http://ip.corporationwiki.com/93.188.161.0/) and should probably be blocked at your firewall.  For that matter, your corporate firewall should be configured to allow DNS queries only from your internal DNS server if you are on a Windows domain.  All clients should be configured to only use your internal DNS.  If this is not the case, you probably are facing a lot of other issues and should call Secure Vizion to get everything working smoothly.... but I digress.

The exact virus or trojan that is changing this setting is not clear, but there is a post at http://www.bleepingcomputer.com/forums/topic318859.html that indicates a virus called "packed.win32.katusha.m"  that may be responsible.  More info on this virus can be found at http://www.securelist.com/en/descriptions/7632035/Packed.Win32.Katusha.m.

Others that have experienced the DNS IP change symptom have reported the virus is identified and removed by their anti-virus application, but the setting remains unchanged after removal. 

If you find this symptom present on a system, DO NOT ASSUME your anti-virus caught and removed the threat.  Check your connections using "netstat -ano", look for any connections to public IP addresses and verify each IP originating location.  You can verify this by searching the IP address you find on Google, or search for "reverse DNS lookup, which will identify the entity that owns the IP.  If you see a connection to any country other than your own be very suspicious.  Contact your anti-virus vendor and ask for help.  If you would rather have professionals dive in and do this for you, well, you know who I would recommend!

Cheers,

Ray