Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some weeks ago I started having problems with my internet connection, it was extremely slow and suddently some websites (specifically gmail, facebook, youtube and twitter) started failing to connect, while the rest connect normally. Some days after, those same websites started showing me a message in portuguese: "Nova atualização disponível" whenever I tried to connect and a .exe file started downloading ("internet_update.exe" or something like that).

That's when I freaked out! It was definitely a virus or something like that, but it was really weird because I never had a problem like that (I run Linux). So I turned on my old PC (running Windows XP) and it turned out it had the same problem! the same message was showed whenever I tried to connect one of those specific websites, while the rest loaded without problems. Even in my Android smarthphone the same message was showed.

So it was obvious that the problem was not in a particular machine but in the router itself. So I started googling and I found some information, unfortunately I only found some in spanish, so I will make you a short summary:

It is a new banking trojan developed specifically to infect and collect information from Brasilian banks. Apparently now it has expanded to Argentina and Peru.

So how does it work? It spreads through social networks (videos, links, ...) and then it "takes control" of your internet connection by changing the values of your DNSs. More specifically, it changes the Primary DNS to one of this IPs:, or and the Secondary DNS to, this secondary DNS is actually the Google Public DNS, and it is configured this way so that your internet connection continue working properly and the user does not notice anything.

The important part here is that because no download or install has been made in your machine, no antivirus will notice any change. After your DNSs have been changed, the trojan controls every single website you connect to and this way they steal your bank information.

So after reading about this I accesed to my router and I restored my Primary and Secondary DNSs to their proper values, but one day after I had the same problem again.

This is actually a 50% warning post - 50% help me! post.

So, here comes the question: Is there any possible way to prevent my DNSs of being changed?

PS: Sorry if this is not where this question should be, but I'm kinda desperate, can you redirect me to the correct website?

share|improve this question

migrated from Jun 6 '12 at 19:27

This question came from our site for professional and enthusiast programmers.

That sounds like an XSS vulnerability in the router – SLaks Jun 6 '12 at 15:38
A (temporary) workaround would be to configure DNS manually for each machine connected to that router. For the router itself, you should try to 1) upgrade the router's firmware or 2) install open-source firmware (e.g. DD-WRT, OpenWrt or Tomato), if supported on your router – user49740 Jun 6 '12 at 19:32
@SLaks what would be the solution for that kind of vulnerability? – juliomalegria Jun 6 '12 at 19:59
@user49740 I've changed my DNSs locally but the problem remains. I will try to upgrade the router. – juliomalegria Jun 6 '12 at 20:00
What type is your router? If it's a FritzBox or something like that, disconnect it from the internet, reset it to factory default, change the access rights and then connect it to the internet again. – ott-- Jun 6 '12 at 20:07

I don't know that it applies in this case, but one way things like this can occur (rare, but possible) is a malignant Flash fragment (downloaded and acted upon by your browser without you even knowing about it) redirecting from your machine to the router via UPNP, and reprogramming the router if the router accepts UPNP reconfiguration.

Even before this became a threat, I determined UPNP to be un-useful to me, and have disabled it ever since (probably 5 years or more now) on all routers I control, and additionally use static DNS servers (OpenDNS in my case) on all machines I configure.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .