DNSChanger Detection Tool

To verify if your system's DNS has been affected by the Trojan “DNSChanger”, we have created a dedicated tool for your use. Please download and run the Free Thirtyseven4 Antivirus Tool below.  Upon execution of this tool, it will display the status of your system- whether it has been affected by DNSChanger or not. In case your system is affected, it will provide an option to Repair the affected DNS settings on your system.

DNSChanger is a Trojan that targets Internet devices such as routers or home gateways.  DNSChanger spread to millions of users worldwide through a highly efficient botnet.  An estimated four million PC’s in over one hundred countries have been compromised.

The DNSChanger attack directs a system’s Domain Name System (DNS) server settings to rogue DNS servers controlled by malware authors.  DNS is an Internet service that converts domain names into Internet Protocol (IP) addresses that allows computers to communicate with one another.

Important System Requirements:

This tool is compatible with the following Operating Systems:

Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2

Download Tool:



Version: 1.0
Type:  Free
Download location: Click here


More Information:

Q: Is there a manual way to tell if my system is affected by DNSChanger?

A: Yes, you can check manually by verifying the DNS Server IP. To check this do the following: Run > CMD > ipconfig/all

If the DNS server’s IP falls in between the ranges shown below then there is a great probability that your system is infected with the DNSChanger Trojan




Q: Is there a way to automatically get my DNS setting operating?

A:  Yes, in addition to developing a dedicated tool for the DNSChanger malware- that identifies if your systems DNS settings have been affected- we have also updated our removal routine for DNSChanger so that if you are infected with this Trojan we will make the necessary temporary system changes for you so that they will not lose their Internet connection on March 8th.  The new routine will change their bad DNS entries to Google's Public DNS shown below:

8.8.8.8 and 8.8.4.4

Please note, you will need to have at least our free trial version of Thirtyseven4 Antivirus installed and up-to-date in order for the removal routine to happen.


Q: How can I manually make changes to my DNS settings?

A:  We have prepared the following webpage to guide you through the process of changing your DNS settings.
http://www.thirtyseven4.com/chkdns.html


Q: Do you offer any additional security tools for free?

A:  Yes, we make most of our security tools available to the public at no charge. We have great tools to clean Rogueware, Scareware (aka. Fake Security Applications), etc.  You can download all these tools from:
http://www.thirtyseven4.com/security.html