The configured DNS server basically tells the web browser where to look for when a web address such as www.ghacks.net is entered into the browser’s address bar. If that lookup is manipulated part or all of the page elements of the website can be replaced by the operators of the rogue DNS server.

The FBI back then replaced the DNS servers that the cyber criminals used with working servers to avoid interruption of service for users affected by the DNS server change.

These DNS servers will however be shut down on March 8th, 2012. Affected users from that day on may not be able to connect to Internet addresses anymore until they replace the DNS server with working ones.

Security company Avira, famous for their antivirus solution, has released the Avira DNS Repair-tool.

You can run the portable program on your system to see if your computer’s DNS server has been manipulated by DNSChanger.

The program will reset the DNS servers to Windows default values if it finds out that they have been manipulated by the malware.

It is alternatively possible to check for manipulation manually.

Use the shortcut Windows-r to bring up the run box. Enter cmd in there and tap on the enter key to open the command prompt. Now run the command ipconfig /all and locate the DNS Servers entry. Compare what you see there with the list of rogue DNS servers below

• 64.28.176.0 – 64.28.191.255
• 67.210.0.0 – 67.210.15.255
• 85.255.112.0 – 85.255.127.255
• 77.67.83.0 – 77.67.83.255
• 93.188.160.0 – 93.188.167.255
• 213.109.64.0 – 213.109.79.255

If your DNS server IPs differ from the ones above then congratulations, you are not infected. You otherwise need to change the DNS server. While you could do that manually, you may prefer to use a program for that. You can use the Avira tool to reset the DNS Server, or a program like DNS Jumper to select a public DNS server instead.

You can download the Avira DNS Repair-Tool from the official Avira website

Windows users who are interested in participating in the beta to get their hands on the security software early, need to head over to the new Avira Beta Center where they need to register an account before they can do so.

Avira promises increased usability, reliability and stability in the new versions. This begins with the installation process which has now been streamlined so that for example Free Antivirus can be installed with just two clicks in express mode.

The programs will furthermore scan for potentially incompatible software like other security software automatically, giving the user the choice to remove the product or keep it installed regardless of the situation.

All program modules have been hardened to take into account new targeted malware attacks against security software. Avira notes that this includes the “ability to function without many registry keys, better protection against process termination and component deletion”.

A Fix Problem button has been added to the software to five users a one-click solution to issues that they encounter. That’s handy for inexperienced users in most cases as the software makes decisions for them.

Components have been updated in the 2012 releases. The firewall for instance is now able to filter IPv6 addresses on the adapter level, and mail and web protection are now able to work in IPv6 environments as well.

The Windows Hosts file will be protected in all Avira 2012 product versions against manipulation and tampering, a feature that was previously only available in Avira Internet Security.

Do the new features justify upgrading or installing the beta versions of the 2012 products? I personally would suggest to wait with the upgrade or installation in work environments, considering that beta products may still cause issues on a system.

Avira recently made two business decisions that may have a huge impact on the company’s public perception. The Ask Toolbar will be rolled out to all free users soon, the UniBlue promotion has already taken place for users in the United States.

Probably the biggest issue that users have with the Ask Toolbar is that Avira suggested to clean that toolbar if found on PCs in the past, according to information posted on DSL Reports. I cannot verify that claim and you should take it with a grain of salt.

Even worse, the toolbar is advertised as a new function called Safe Internet searching. It has been re-branded as the Avira SearchFree Toolbar and works with Internet Explorer and Firefox.

Many inexperienced users may be inclined to install the toolbar, considering that it is supposed to make their Internet searching safer.

Free users get the web guard component activated in Avira if they install the Avira SearchFree Toolbar. The component will only be available as long as the toolbar is installed on the system.

Avira notes that the toolbar is installed in an opt-in process. Existing users get a notification about a new function eventually. This notification pops up at the bottom of the computer screen. Note that you can select Install Now or Install Later, but not to say no to the installation.

A click on Install Now opens the installation dialog. The toolbar is not selected by default. Users need to check the “I accept the terms of the Ask.com End User License Agreement” box to do so. If they click Next without enabling that feature nothing will change. If they do, they see the new AntiVir WebGuard module listed under installed components. It is not necessary to make Ask the default homepage to receive the WebGuard module.

There has already been some backlash from users, for example at the Web of Trust forum.

I can understand bundling with an installer to try to create revenue, however bundling with someone that you had once listed as malware… and then removing them from the database is just like saying “Yes, we are for sale… but trust us we won’t let anything bad happen to your systems.”

This happened to me this morning. I went to do my weekly scan & after doing the scan I did an update which must have been the service pack because it was quite large. Then this popup announced webguard & the Avira toolbar. There is no way to say no. All the popup says is “install now or install later”. No choice to install webguard without the toolbar. So I am simply closing the popup whenever it shows up.

Other sites where the issues are discussed are the DSL Reports forum and Wilders Security.

I personally do understand that companies want to make as much money as they can and that it can be very tempting to bundle software with free products to do so. What Avira may have neglected to consider is the negative perception of both partner companies on the Internet. It is usually the tech savvy users who get frustrated with a product and stop using it. This also means that they stop recommending it which could in the long run reduce Avira’s market share.

Are you currently using Avira products? If so, what is your take on the situation?

My thanks goes to Nico who submitted the news via email.

But what about on-demand virus scanners? Avert, which stands for Automatic Virus Eradication & Removal Tool, is a free program intended to be used on already infected systems, or systems that a user wants to scan with multiple antivirus engines to be sure that no virus, trojan, worm or other malicious program is found on it.

Avert can scan the computer system with eight different antivirus engines. By default, it will only download and run VIPRE. A click on the Tools and Settings button in the lower left corner displays the options where scanners from A-Squared, ClamWin, Trend Micro, Sophos, Panda, Avira and VBA32 can be selected. A click on Download loads the programs to the directory of Avert, and makes them automatically available for future scans.

Everything is kept portable, so that it is possible to move Avert and all downloaded antivirus scanners to another drive or computer.

The program directory with all antivirus tools included has a size of 313 Megabytes, less if only some of the virus scanners are downloaded.

In addition, Avert offers to run CCleaner and a set of three tools on the system. With CCleaner it is possible to remove temporary files to free up disk space. The three tools are available to backup the Windows Registry and reset the Windows Hosts file and proxy settings.

The depth of the scans and utilization of the included tools can be configured in the program’s main interface.

The virus scans can be configured before the start. Avert offers to run a full system scan, balanced, quick or custom scan. CCleaner can only be run in thorough mode if enabled, and the three tools can be enabled individually.

The individual programs may download the latest antivirus signatures if updates are available. These signatures do not seem to be saved locally, which means they need to be download every time the program is run. Vipre needs to be downloaded every time as well, because the developer does not offer an option to download the signature file separately. Avert runs all selected programs consecutively afterwards.

Avert is a free portable software for Windows. The program requires the Microsoft .net Framework 2.0. (via)

No Notify Avira has been designed by the developer to provide inexperienced computer users with an option to disable the Avira Antivir popup ad effectively. The program supports AntiVir Free 8, AntiVir Free 9 and the latest Antivir 10.

The program displays a command line prompt giving the user the choice to remove the advertising in Avira Antivir 8, 9 or 10 which can be selected by pressing the keys 1 to 3 on the computer keyboard.

No Notify Avira will then make changes to the Windows Registry to disable the advertisement in the selected Anvira Antivir application.

The software program is fully portable and compatible with 32-bit and 64-bit editions of the Windows operating system. Some operating systems might require to run the program as administrators to make the changes to the Registry.

The latest version of Avira Antivir identifies the program as a virus which is a false positive. Cautious users can check the software at Virus Total.

No Notify Avira is available at the developer’s website. (via Webtrickz)

Avira has published their January statistics of the most phished brands. This information can be helpful to identify or avoid services that are targeted the most by phishing attacks.

Most of the phishing attacks are carried out against financial services and sites. The only non-financial service in the top 16 list is Facebook.

The phishing list is tipped by PayPal which was the target of the phishing attack in 61.89% of all cases followed by HSBC Bank with 8.59% and Bank of America with 6.09% of all attacks.

Other companies in the list include Ebay, Abbey Bank, Chase Bank, Banco Poste Italiane, Alliance Leicester, Western Union and Citibank.

It is obviously not always possible to switch a company or service based on the phishing statistics but it should warn users that use these brands to be very cautious when they receive emails that seem to come from those companies. (via Avira)

Followed by no file type at all (e.g. pointing the user to a root url or directory) with 18.99%, the txt file extension with 10.37% and php with 6.56%.

This requires some explanation. Most users would probably agree that text files are harmless. This is not always the case especially when it comes to links as links can be redirected easily. But attackers can also rename an executable to txt and use malicious code on a website to run the file.

The statistics basically points out that while the standard file (exe) associated with a computer virus is making up more than 50% of all attacks it is of equal importance to understand that harmless looking files and links can be malicious as well.

The safest bet is still to avoid clicking on links or attachments in emails. A sandboxed environment or a virtual PC are two secure alternatives if the link needs to be clicked on. (via Avira Blog)

One interesting aspect of the chart is that Chase Bank and ebay battled it out for most of the year and that PayPal began its rise in December which Avira attributes to the Christmas season and the increased usage of PayPal in that season.

Several other brands experienced a lot of phishing attacks as well. Here is the top 10 list according to Avira:

• PayPal 32205 threats
• Chase Bank 25901 threats
• eBay 18738
• American Express 5202 threats
• Bank of America 4540 threats
• Abbey Bank 3978 threats
• IRS 3712 threats
• HSBC Bank 2762 threats
• Citibank 2265
• Facebook 2217

All of the brands in the top 10 with the exception of Facebook are brands related to the finance sector or shopping. It certainly is an interesting trend that the attackers were able to produce that many phishing websites in December alone to make PayPal rise to the top of the statistics.

The statistics collected by other companies will probably differ marginally but it is likely that the top brands listed in the Avira list are also the top brands in their listings. PayPal users should be very cautious at the moment.

Avira made an announcement a few days ago where they addressed that problem somewhat. They mention that they have realized that “users of the free Avira AntiVir Personal had issues fetching the Updates in time recently”. This is not exactly the same issue but it could very well be related.

Avira therefor decided to implement the following two changes: Change the virus definition file format and use a content distribution network.

First, we switch from our current virus definition files (called iVDF) to a new format called nVDF. iVDF consists of 4 VDF files, while nVDF uses at least 32 files – we need to transfer less data for updating our virus definitions effectively in the future.

This means that we need to deliver about 25 MByte to every Avira installation starting today for switching to the new update system. This might lead to some delays for some users, especially for the users of our free version Avira AntiVir Personal. Just to get an idea about what we’re talking here: More than 100.000.000 Users are trying to get the update more or less on the same day. That is more than 2.5 Petabytes (or 2,500 Terabytes) of traffic.

The previous format used four files that contained all the virus definitions of the program. The new format splits those virus definitions in at least eight times that number so that it will take less data transfers to update the virus definition files (it theoretically could slow down as well if a majority of the files need to be updated as this would mean that more files need to be transferred than in the old update system, but that’s just speculation as there are no technical information available about the process at this point).

To ease the bandwidth bottleneck, we decided to additionally use a Content Delivery Network (CDN). We were first testing a CDN built up by our current Internet service provider. Shortly after activating the CDN, the redirectors – which redirect the update requests to servers close to the users location – were overloaded and couldn’t answer the requests anymore. The situation was solved a little later on, but the CDN isn’t big enough yet to spread this huge update in time. So we decided to switch to a global player in the CDN market to deliver the update.

The second change is the use of a content delivery network. Avira is building up their own CDN but had to contract a global CDN company to spread the massive update to all Avira users. It is likely that they intend to switch to their own CDN at a later time.

It does sound like a good plan though although the massive data transfer to bring the update to all Avira users could prove to be quite a challenge. Did anyone already receive the update?

Luckily though Ghacks reader Dante found a solution for the problem which he send in as a tip to share here at the website. The Avira update problem seems to only affect the automatic update of the antivirus software. What is not affected at all is the manual update process.

To fix Avira Antivir Update problems a user would therefor need to aquire a new virus definition file and update the software manually with it. This fixes the broken automatic update in Avira Antivir:

• Download the latest antivirus definition file for Avira Antivir at Softpedia.
• Bring up the Avira Antivir interface.
• Select Update and there Manual Update
• Use the file browser to select the downloaded updated definition file
• Wait until the update has finished.

The manual update of the antivirus software will fix the broken automatic update in Avira so that it can be used again afterwards. Thanks go to Dante for sending in the tip.

It should not be a problem to use the license code in Antivir Premium versions that use a different language. It did work the last time I tried it. The online registration form asks for name, email and country. The information send to the email address is also directly available at the website after registration.

Basically an account at the Avira website is created with a six month license for Antivir Premium. The download link for the premium version and the required HBEDV.KEY is directly available in that account center. If you already have Antivir installed uninstall it before making the installation of Antivir Premium.

The Premium version will ask for the HBEDV.KEY file during installation. Just select it from your hard drive and everything should install just fine and without problems.

The personal free edition of AntiVir 8 has two new features or improvements listed on that page. The first is a raised scan speed which is always nice obviously and the second a redesigned visual appearance. The other versions of AntiVir contain a new system to create Rescue-CDs and the Security Suite a new option to backup data.

Windows Vista Service Pack 1 is supported now as well and there is an option to choose between software updates and updates of the virus definition lists. The size of the download is roughly 22 Megabytes and it is still possible to perform a software update right after installation which I would recommend.

The premium version of AntiVir sells for €19.95 (that’s Euro) usually and adds protection against spyware, adware. pop3 email protection and fast updates through premium servers in comparison to the free version. Both versions protect against viruses, dialers, phishing, worms, trojans and rootkits.

Make sure you fill out the form above and download the Personal Edition Premium from the Avira servers.