Skip to Content

CIRA hosts DNSChanger Malware Checker

Ottawa, March 14, 2012 - The Canadian Internet Registration Authority (CIRA) in collaboration with the Canadian Cyber Incident Response Centre (CCIRC) at Public Safety Canada has developed an online DNS Checker to screen user's computer for the DNSChanger malware that has affected approximately 20,000 Canadian computers.

What is the DNSChanger Malware?

Recently, through Operation Ghost Click, the FBI uncovered a sophisticated cyber criminal activity that infected millions of computers around the world with malicious software without the user’s knowledge. The malware affected the Domain Name System (DNS) of the targeted computer and redirected unsuspecting users to rogue DNS servers, allowing the cyber criminals to manipulate the user’s web activity. This malware is called DNSChanger and detection and removal of the malicious software is extremely difficult. As a resource for Canadian Internet users to screen their computer for the malware, CIRA, developed an online DNS Checker.

How does the DNS Checker work?

Once the user agrees to the Terms and Conditions, the DNS Checker will match the user’s Internet Protocol (IP) address against known Operation Ghost Click IP addresses. When completed, the user is greeted by either a green banner, which indicates that their computer is not infected with the malware, or a red banner, which indicates that their computer system may be infected with the malware. If the banner is red, the user is encouraged to consult the Public Safety Canada website that provides further information on detection and removal of the DNSChanger malware.

The DNS Checker will not screen the user’s computer for any other virus, malicious code or malware.

You can check your computer by visiting

For more information please contact


About CIRA
The Canadian Internet Registration Authority is the organization that manages Canada’s .CA domain name registry, develops and implements policies that support Canada’s Internet community, and represents the .CA registry internationally.