Troubleshoot I need urgent help to remove DNS Servers "82.163.143.136” and “82.163.142.138”

[Rebsat]

Hi everyone. Unfortunately, I think I’ve been infected by DNS Changer malware. I have a Lenovo with Windows 10 x64 system. I scanned my laptop with a powerful Dr.Web CureIt! malware scanner but couldn't find and remove these DNS servers:
82.163.143.136
82.163.142.138

I didn't try Kaspersky Virus Removal Tool and Malwarebytes AdwCleaner yet. I would greatly appreciate your good assistance. I need your advice, please. Thanks

 

[mekelek]

scan with zemana, it detects dns hijacking and fixes it

 

[TairikuOkami]

Try resetting network adapters or forcing DNS with Dns Lock v1.3 in the meantime.

Reset Network Adapters in Windows 10

 

[upnorth]

Do you use the GreenTeamDNS service? : GreenTeam Internet | Come as user stay as family...

 

[mekelek]

Do you use the GreenTeamDNS service? : GreenTeam Internet | Come as user stay as family...

that DNS is totally different tho?

 

[harlan4096]

@Rebsat: please visit this section of the forum: Malware Removal Assistance For Windows

It seems or probably a similar DNSUnlocker/Zlob.DNS Changer adware infection...

 

[upnorth]

that DNS is totally different tho?

Good point as there official servers are set manual and not the same but when I did a bit deeper search I found that GreenTeamDNS is located in Israel as also those 2 DNS servers @Rebsat reported. With a Traceroute search it goes through in the end steps Bezeq International-Ltd in Israel and ends up in, Green Team Internet LTD in Israel. GreenTeamDNS homepage is even branded with " © GreenTeam Internet, Ltd ". The thing that raised my eyebrown was that GreenTeamDNS uses a .uk domain but there located in Israel? About Us | GreenTeam Internet Ofcourse anyone that creates or run a site can choose whatever domain they want but I also noted there not using https and that's not common for a DNS service provider.

Correct me if I'm wrong.

That sayed I would still advice the exact same as @harlan4096 because I also belive @Rebsat needs to get help from @TwinHeadedEagle first.

 

[Rebsat]

@mekelek omg, it worked! Thank you very much, bro You are a lifesaver

@TairikuOkami @upnorth @harlan4096 Thanks for your suggestions brothers


Zemana AntiMalware has successfully found and removed both DNS servers from my laptop.
Please check the images below:

 

[Evjl's Rain]

perform a scan of your C: drive with zemana
you are good to go

scan your PC with norton power eraser to see if it find something zemana missed

 

[mekelek]

@mekelek omg, it worked! Thank you very much, bro You are a lifesaver

@TairikuOkami @upnorth @harlan4096 Thanks for your suggestions brothers


Zemana AntiMalware has successfully found and removed both DNS servers from my laptop.
Please check the images below:


View attachment 187082


View attachment 187083


View attachment 187084


View attachment 187085

yea as ZAM shows you had an Adware
what is your security suite? Avast?

 

[Rebsat]

Do you use the GreenTeamDNS service? : GreenTeam Internet | Come as user stay as family...

Not at all. I never used that DNS.

 

[Rebsat]

@Rebsat: please visit this section of the forum: Malware Removal Assistance For Windows

It seems or probably a similar DNSUnlocker/Zlob.DNS Changer adware infection...

Yes, it was:
Adware:Win32/DNSUnlocker.E!Neng