DNSChanger Malware Infection Test Script (VBScript)

  • Print
Details
Category: Scripts and Code
Published on Wednesday, 28 March 2012 15:00
Written by Christian Dunn
AddThis Social Bookmark Button

This script checks the DNS settings of your computer to identify whether you are potentially infected with DNSChanger. DNSChanger is a serious malware infection that can change your DNS servers. A temporary global fix has been put in place until July 9 2012. At this time this fix will no longer work and infected machines may not be able to access the internet. For more information from the DNS Changer Working Group see http://dcwg.org/index.html

'##################################################
'DNSChanger Test Script
'----------------------
'Created by Christian Dunn March 2012
'ACMA Alert & Self Test Site: http://dns-ok.gov.au/
'##################################################

Dim IPstring, error, myarray

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set IPConfigSet = objWMIService.ExecQuery _
("Select * from Win32_NetworkAdapterConfiguration Where IPEnabled=TRUE")

'SET HEADER

IPstring = "If any of the following DNS addresses show AT RISK you may be infected with DNSChanger. Check online at

http://dns-ok.gov.au/" & vbCrLf & "------------------------------------------------------" & vbCrLf

'SCAN TO FIND DNS SERVERS

For Each IPConfig in IPConfigSet
If Not IsNull(IPConfig.DNSServerSearchOrder) Then
For i=LBound(IPConfig.DNSServerSearchOrder) to UBound(IPConfig.DNSServerSearchOrder)

'FOR EACH DNS SERVER THE FOLLOWING RANGE CHECK OCCURS

IF not left(IPConfig.DNSServerSearchOrder(i),7) = "0.0.0.0" then

myarray=split(IPConfig.DNSServerSearchOrder(i),".")

Select Case left(IPConfig.DNSServerSearchOrder(i),7)

Case "85.255." ' CHECKS FOR 85.255.112.0 TO 85.255.127.255
If int(myarray(2)) > 111 and int(myarray(2)) < 128 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If
Case "67.210." ' CHECKS FOR 67.210.0.0 TO 67.210.15.255
If int(myarray(2)) >= 0 and int(myarray(2)) < 256 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If
Case "93.188." ' CHECKS FOR 93.188.160.0 TO 93.188.167.255
If int(myarray(2)) > 159 and int(myarray(2)) < 167 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If  
Case "77.67.8" ' CHECKS FOR 77.67.83.0 TO 77.67.83.255
If int(myarray(2)) >= 83 and int(myarray(2)) <= 83 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If 
Case "213.109" ' CHECKS FOR 213.109.64.0 TO 213.109.79.255
If int(myarray(2)) > 63 and int(myarray(2)) < 80 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If
Case "64.28.1" ' CHECKS FOR 64.28.176.0 TO 64.28.191.255
If int(myarray(2)) > 175 and int(myarray(2)) < 192 then
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " AT RISK" & vbCrLF
Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End If  
Case Else
IPstring = IPstring & IPConfig.DNSServerSearchOrder(i) & " CLEAN" & vbCrLF
End Select
end if
Next
End If
Next

'SHOW THE RESULTS

Msgbox IPstring,64,"DNSChanger Test Results"


Details