This article helps with the DNS Unlocker “Virus” removal from Chrome, Firefox, IE and Android phones. If a DNS Unlocker removal tool is what you are looking for, we can help you with that as well.
Remove Ads by DNS Unlocker
DNS Unlocker removal tool is a program known to belong to the well-known adware class. It is marketed as supposedly being able to grant you access to blocked websites and digital media, free of charge. Unfortunately it does not deliver. As you can tell from its name, that’s not quite the point of adware programs, merely the pretense of their legality. This type of software is designed for all of the most popular Internet browsers (Chrome, Mozilla, Internet Explorer) and has been well documented to induce numerous advertisements in the form of pop-up windows and browser redirects such as my quick converter, layers of banners and random in-text links on pages, where they normally aren’t present. We strongly advise you against clicking on any of these ads, because it is very common for them to sometimes be fake or just pose a clever ruse for the user to be tricked into clicking on the specific pop-up or link. Once this happens you will in many cases be redirected to shady websites and prompted to install different types of software under the pretense of missing “codecs”, different program updates, anti-virus programs or tools to deal with a “detected” threat. These are exactly the types of things that would have you end up in a situation where a DNS Unlocker removal is unavoidable. You can see another prime example of this type of software in our Zeus Virus Detected instructions.
All that being said, however, please note that adware is not to be confused with a virus or other type of malware (‘malicious’ + ‘software’ = malware). It is an annoying piece of programming, but it will not directly harm your computer or the data stored on it. Specialists like to refer to these types of things as potentially unwanted programs or PUP.
One of the reasons why DNS Unlocker would be potentially unwanted was described above, but there’s also another, no less important reason for you to consider ridding yourself of this parasite as quickly as you can. Adware is notorious for collecting you browsing related information, since it needs to optimize the content of the ads and make it more appealing to you. This information, which might include your geolocation, IP address, favorite sites, search queries and even personal details you’ve entered somewhere, is stored, analyzed and quite likely sold to third parties. We assume you can extrapolate the dangers of there being cyber criminals among these third parties and what that could result in, should your data land in their hands. So even though DNS unlocker is not a virus you should strive to have it removed from your machine – the sooner, the better.
In addition to these more serious ways in which the DNS Unlocker “virus”can affect you, you could also expect to experience one or more of the following symptoms related to being infected by adware:
- General slowdown of your PC;
- Various system errors;
- Possible gathering and installation of other adware.
When it comes to dealing with nuisances like the DNS Unlocker “virus”, understanding how it came to be on your PC in the first place is paramount. There are several ways this could have happened: Spam email is the first and most widely used method, but probably the least effective one. The second and by far the most lucrative one are freely distributed programs bundled with adware. These packages contain unwanted “extra content” that is firmly seated on the thin grey line between legal and illegal. You will typically find these on open-source download platforms or torrent websites. Once downloaded, a common mistake many people make (apart from not reading the EULA) is choosing the default setup settings. This is what enable the developers to stealthily include the bundled in adware, because you have technically already given your permission for that. So they end up having to deal with some DNS Unlocker removal problem. For this reason, we highly recommend choosing the advanced/custom settings for any such installation, because it will allow you to view what ‘complimentary’ programs have been included and give you the option of permitting or not permitting them to be installed as well.
An additional piece of information:
You may (or may not) encounter this Adware with a varying degree of other names, like powered by DNS, powered by DNSUnlocker, brought by DNS Unlocker, etc. The name doesn’t really matter. It’s all basically the same thing, so don’t be confused even if there are small differences. The DNS Unlocker “Virus” refers to the practice of advertisement platforms labeling their ads to increase their own renown. In reality it doesn’t mean anything. We’ve already had several people in the comments confused by this, so we wrote it down here to make matters clear.
SUMMARY:
| Name | DNS Unlocker |
| Type | Adware/Browser Hijacker hybrid |
| Detection Tool |
DNS Unlocker Removal
You are dealing with a malware infection that can restore itself unless you remove its core files. We are sending you to another page with a removal guide that gets regularly updated. It covers in-depth instructions on how to:
1. Locate and scan malicious processes in your task manager.
2. Identify in your Control panel any programs installed with the malware, and how to remove them. Search Marquis is a high-profile hijacker that gets installed with a lot of malware.
3. How to clean up and reset your browser to its original settings without the malware returning.
You can find the removal guide here.
For mobile devices refer to these guides instead: Android , iPhone
Please help, i’ve tried everything and can not remove it, DNS lookup and coupoon keep spamming me and make my webpages run slower.
First questions: What browser(s) are you using? Also, Is Ads by DNS Unlocker present in the browsers or you can’t locate it this way?
This tutorial works awesome but you still need to add one more thing to it! I followed your tutorial and at the end, I was still stuck with some kind of app that was causing my google chrome to populate coupon on every page I would visit! After investigating, I found out that the damn “DNS Unlocker” had modified my DNS settings! After fixing this I was completely good! I have google chrome, so I am unsure if this fix persist to other browsers.
The path to do this follows:
Control Panel > Network and Internet > Network and Sharing Center > Change Adapter Settings > Right-click your active internet connection (usually Wi-Fi since everyone uses that, unless your using a desktop) and click properties > Now under the Networking tab, scroll down until you find Internet Protocol Version 4 (TCP/IPv4) > Highlight that then click on properties > Both options in this windows should be automatic! The first option should be set to “Obtain an IP address automatically” and the second should be set to “Obtain DNS server address automatically!” If your computer belongs to a company or you actually have a custom DNS then this would not apply to you. Once you are finish, click “OK” and close the windows > Now go back into Chrome and reset your settings one more time and boom! It should work just fine.
Thank you for the information! It’s very helpful. I’ll add it to the DNS Unlocker removal guide immediately.
Help please
I have followed all instructions above and still find the DNS pop ups appearing whilst I browse???
using windows 8 and IE 11
Try the updated last step.
If you mean step 7 already did that or do you mean step 8?
I followed all of this and the virus is still showing up on google chrome. Do you have any further tips? I appreciate all of your help.
In the hosts file in step 4, after local host it says “start of entries inserted by Spybot search and destroy” and after that I would estimate there are probably more than a thousand entries with the same IP address as local host. I uninstalled Spybot s&d but that did not change anything? What now? Thanks for your help
Try again now. I updated the guide again.
DNS was not listed as an extension on Chrome when I opened it, but it’s definitely on my computer. I had local host in that text file as well. I went ahead and uninstalled it, but can’t find which processes running are DNS. Please help!
I also don’t have an ads popping up
I did all those steps and nothing changed 🙁
I’m using Windows 7 and Opera.
For anyone asking: I clearly stated in the removal guide that if any step is not applicable for you, you should just skip it. These things change – they may be in your extensions – or not.
I just updated the guide again. Hopefully now it will help you. This virus seems to change every few days and it’s hard to keep up with it.
I am hacked!!
In step 4 I found 2 ips.
What to do?
What are the names next to the IPs? Are there names? Describe what exactly you see.
I also have some ips, thislinkeskipsanyemptylines; mirillis.com; http://www.mirillus.com; serwer2.paka-service.com; ns386119.ovh.net; mirillis.pl
I can’t find any information about these? Do you have any idea how these got there. My recommendation is to either install professional software that would scan your files for malware, or copy these adresses to a .txt file and delete them from your HOSTS file. See what happens then.
Please, leave a comment to tell me what happened, I really want to help you 🙂
Hi i found an IP in step 4. When checking what programs had recently updated or been installed, only my McAfee was the one which had automatically updated without me physically doing it. Going back to step 4, under the localhost section in notepad i have got: 0.0.0.1 mssplus.mcafee.com Any suggestions?
No, that’s perfectly fine. Mcafee shouldn’t have anything to do with DNS Unlocker. I was referring to possibly seeing a bunch of ips that have no designation, no mssplus.mcafee.com etc. This is OK. Go on with the guide – the updated last sections should do the trick if the rest fails.
Hi. I have had an attack with the dnsunlocker virus. Having meticulously followed the instructions above I noticed that when I go to manage add ons to disable dnsunlocker there is no such extension. Am I missing something here.
Thanks for the tutorial.
No, you’re doing everything fine. DNS Unlockerk just changed – virus creators like to change their creations with time, so that removal guides like ours don’t work properly. there’s no way to know which “version” of the virus you have, so we listed everything needed to get rid of it. Just move on to the next step and you’ll be fine. But make sure to cover all the steps even if you don’t see it. There’s always a chance you may miss something.
Hi
Why nowhere is written about android devices being defected with dns unlocker. I’ve problem with these ads on my mobile
Hi
Unfortunately nowhere is written about the android devices defected by this virus. I’ve found it on my mobile.
I will add an android section today.
Hi, I’ve had the DNS Unlocker problem from a couple of days ago, and am using the Safari browser on a MacBook Pro. May I know what steps I should take? I’ve already tried looking for browser extensions, but there were none. Thank you!
Try everything disclosed in the guide first. We updated it recently (check the last 2 steps of the PC guide). If nothing there works, leave another comment and I’ll try to help you in another way.
The only thing that has installed onto my computer in the last week are Microsoft updates, so it’s obviously attached itself to them somehow. I can’t get rid of it at all and it re-installs every time you restart the PC. That’s yet another PC knackered by people who have nothing better to do.
If it reinstalls itself on reboot, your DNS Unlocker removal should definitely be 100% about regedit. See the updated parts in the guide – you must be missing something. If you can’t do it, leave another comment for me and I’ll assist ou 🙂
Hi there, I am 13 and I have recently encountered DNS Unlocker and I’ve always uninstalled it at the ‘Uninstall a Program’ section. My PC ran fine until a few months DNS Unlocker comes back, and it does not show up at the Uninstall a Program section, neither is it also at the Extensions section on my Chrome browser, it’s the browser that I use a lot often. Please help!
Did you cover all of the steps described here, particularly the last 3 steps?
It’s not a problem if DNS Unlocker doesn’t show up in Chrome or the Control Panel. Just move along and continue with the guide. There are different versions of the virus, and some show up in the control panel & the extensions, but others don’t. There’s no way to know which version yuo got exactly. Don’t hesitate to ask other questions.
I advise you to just complete the guide, and if it’s not gone when you finish, ask me and I’ll give you pointers 🙂
I have had this virus sneaking around my computer for months now. I’ve been following the guide so far and have found many files and folders whose names are comprised of nothing but random numbers and/or letters littered all throughout my Registry, Program Files, Program Files (x86), ProgramData, AppDataLocal, Extensions, etc. I have no Idea whether or not I should delete any of these files or folders since they give no information as to what they actually are or do. A decent amount of these folders have files with the type name “YYoutouubeAdBlocKe”, sorry the only screenshot I took of that is in the Temp folder. (I had the AdBlock Plus extension for google for a while, but I don’t think that’s the type name used by that extension. Also the vast majority of the files with that type name come back after shortly after being deleted.) I didn’t take screenshots of each and every one of the Folders/Files mentioned above, just some to provide examples. I also have AdAlert and Bueno Search Toolbar plaguing Chrome (I’ve never had any ad spam related problems with Bueno Search. I can usually just remove the extension and it won’t bother me again, but the extension always comes back after resetting chrome and removing whatever profile is active at the time from Users), and some extension named Best Save For You on IE (I haven’t used IE once ever on this computer either. I found out about that extension when following this guide.) I followed the guide as best I could and it didn’t help at all. Could this all be fixed by simply restoring the computer to Factory Settings or by doing a Factory Restore to a much earlier date? I am completely fine with losing all my data if it means this garbage will be gone.
I suggest you use SpyHunter’s scanner. It can point you in the direction of the infected files. If you have difficulties, I’l help you remove them myself.
A factory reset works almost 100% of the time. You should not have any trouble after a factory reset.
Hello all,
If you still cannot get rid of DNS Unlocker even after following all the 8 steps, try this out.
1. Go to network connections.
2. Internet protocol version 4.
3. Select “Obtain DNS server address automatically” radio button.
4. Click on “Advanced”, “DNS” tab.
5. Remove any entry in “DNS server addresses, in order of use.”
Problemo solved !!!!
PS: Step 3 would give you a solution in most of the cases.
Happy browsing.
1.The only I am unable to follow is Step 7 (Updated !), I can’t do anything other than install it.
2.I’m confused on what Step 3 is trying to tell me; either to actually remove everything or type (remove everything here) after .exe
3.Another problem is after using this guide DNSUnlocker has gotten significantly worse and that it’s still on the computer.
If the problem is still occurring then it is recommended that you do.
Hey. I got to the final step in the update and it says it cannot delete some of the Temp files because they are either open in Adobe or in the COM Surrogate. What does that mean and how can I fix it?
Hello, Breanna. You might try to copy the whole folder on another partition and try to edit it and then replace the existing one with the edited files. If the problem still persists, we suggest you download the software listed in the article above and use the free scan function to locate your problem files. Let us know how this goes.
HI,
I have made every step, but though DNS Unlocker is still on my computer… What can I do?
At step , I have this:
# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost
Thank you very much for the help
Elise
Hi Elise,
Could you please explain in detail which steps you managed to complete and which you weren’t able to.
Hi, I was just wondering, will a PC reset work in removing this? Up until this morning when I opened my computer the adware hadn’t installed itself and everything I needed backed up was already saved to an external drive. Just to be safe I went ahead and decided to reset my PC and wipe all the files, programs and drivers. It’s just short of a full factory reset, so this way the files are gone but the OS (Windows 10) and the programs pre-installed on the computer when I got it will be reinstalled upon reset.
Long story short: should this get rid of the DNS Unlocker? Unfortunately it’s not my first time it’s happened and I’m pretty careful about what I install since it happened the first time. So I figured that a full reset would probably work. In the event it doesn’t work, would you suggest I try going through the steps here again, or would you suggest a full factory reset?
Hello Donovan,
In theory what you are describing should work. If the problem reappears we would recommend going through the steps again and considering installing the software from the article above, the scan function is free and can at least pinpoint your problem files. A full factory reset should be a last resort solution.
This actually worked!! I had to find it manually in regedit with ctrl + f “dns” and I’m so glad it’s finally gone! Thank you!
No problem 🙂 Glad we could help.
The steps above got rid of it for me!! Thank you so much!! I will look to you first for help with any viruses. I went through three other extremely long and time consuming processes that did not work. You’re now in my Favorites!
Glad to hear we managed to help you! 🙂
hi i found several host names in step 4 as follows: down.baidu2016.com, 123.sogou.com, http://www.czzsyzgm.com, http://www.czzsyzxl.com. how to fix this pls help
Hello Monika,
You’d better delete them from your hosts file, they indeed look quite suspicious, you can save them to a .txt file first though, just in case something goes wrong, you can add them again manually.
Let us know afterwards how that goes for you.
You are welcome anytime 🙂
Hello again monika. Don’t worry, you are not bothering us 🙂
Download the scanner from one of our advertisements. It should point you towards any infected files you might have missed. I’m willing to bet there’s something in regedit you didn’t see. Try with the scanner and tell us how it went.
Thanks you a lot, I’ve been searching through a lot of guides and this one is the best by far. At least I’ve got rid off that shitty adware.
Hi Bronia,
Have you tried already to reset your browser? You can find the instructions on how to do it here https://howtoremove.guide/android-malware-removal/
Please try that first and let me know of the outcome. Thank you.
Hi Varun,
These settings are OK, this file is safe and the problem lies elsewhere.
Can you open the network settings of your adapter and tell me if any changes have been made to the ICP4/IP protocol?
Glad i could help!
Hi Meg,
This line is added if you had (or currently have) Mcafee installed on your PC. It helps it load updates. Feel free to remove it if you want.
Hi Steven,
Please open the network connections (should be a computer icon on your task bar)-> network and sharing for Windows 10. Select the adapter by clicking on the line after Connections, click on properties, click on the IP4 protocol, click on properties.
Do you have any numbers in the fields there?
Hi Kirstie, can you do the following:
Please open the network connections (should be a computer icon on your task bar)-> network and sharing for Windows 10. Select the adapter by clicking on the line after Connections, click on properties, click on the IP4 protocol, click on properties.
Do you have any numbers in those fields?
Hi,
Can you go to your network adapter, press properties, then select IP4 from the list and click on properties again. Do you see any numbers written in the DNS field?
Hi, you need to delete these lines from the hosts file, then save it afterwards. If that doesn’t work do the following:
Search for Notepad in windows search, right click on it and select Run as admin. When the program runs use the inside “Open” menu to open the hosts file and delete the lines.
Hi Vikki, what you need to do is simply delete those lines from the file, then save it. If you don’t get permission to do that first run Notepad as an admin (search for notepad in windows search,, right click on exe-> run as admin) and then open the Hosts file from the inside menu of Notepad: File->Open.
Hi Maverik, did you try using an ant-malware program like Spyhunter already?
hi I have these in my host
127.0.0.1 down.baidu2016..com
127.0.0.1 123.sogou..com
127.0.0.1 http://www.czzsyzgm..com
127.0.0.1 http://www.czzsyzxl..com
0.0.0.1 mssplus.mcafee..com
Hi Cassandra,
You likely have an illegal copy of McAfee installed, that’s what the last line is about. All other lines related to chineese sites should be deleted.
That’s nothing. It’s perfectly safe 🙂 Did the guide work for you?
Is this in safe mode or out of it?
Did you try Spyhunter, the scanner from one of our ads. The paid version is for automatic removal. The scanner is free, so just use it to help you find the infected files, then use our guide in conjunction with it.
Did that help you? Tell me if it doesn’t, in the meanwhile I’ll try to think of another way to resolve your situation 🙂
Hi Cloud, I’m glad you were able to solve the problem regardless.
Hi Lyle, thanks for the feedback. That’s why downloading codecs from un-trusty sources is a really bad idea.
Well can you tell me exactly what you did?
Hi Tianna, just delete them from the file, then save it.
Hi there, just delete them from the file. If you are not able to save the file afterwards do the following:
Do a Windows search for Notepad.
Right-click on the executable that comes as the search result -> Run as administrator
When notepad opens press File->Open and navigate to the hosts file in the windir/system32/Drivers/etc/ directory
You should be now able to save the file after deleting the IPs.
These are definitely part of DNS Unlocker – or something else that was installed with it. Delete the lines from the file and save it.
Try downloading the scanner from one of our ads – it will help you find any leftover files you missed.
Did this help? 🙂
I was reluctant to download anything more but did so as a last resort as my computer was basically unusable anyway. 86 issues detected, went through and deleted all that was found and now computer is as good as new. Thank you so much for this page!!
No. I recommend downloading the scanner from one of our ads, so you can find the adware files more easily.
Yes, using SpyHunter is definately the easiest way to do it. Otherwise you have to hunt them down manually.
I just typer in %temp% and hit enter. Do i delete just the files or everything that has come up e.g. .temp files and the random number and letter in bracket files, or just everything from the place i was sent. Thanks for the help in advance
Hello TehDracona, just to be clear of any possible confusion – which step are you referring to?
Delete the files inside the folder. That’s it.
Hi Eimy,
“when I click open and go to host files it says it’s empty”
what do you mean exactly?
you can’t locate/see the hosts file? Please elaborate so we can help you.
Hi Eimy,
please give us more information about these IPs you are trying to remove, post them here or provide us with a screenshot, so we can know more about your issue.
Hi Breeana,
that is because we are receiving a lot of Spam and the comments are moderated before posted on the site.
Hi Big guy,
nobody wants any of these harmful contents. They just find their way in our system. Contact us if you need further help.
Hi Jessa,
did you run Safe Mode WITH Networking ? In Step 1 there is a guide you can check.
Hello, Please the malware infected my Android Device and I do share hot-spot to my PC since the virus infects Dns my PC is affected automatically too.
Please can you give a procedure to remove the intrusive virus on my Android Device.
Hello, Pelumi. Try going to Settings > Applications on your Android device. Then go to the “All” section and look through the apps. See if there is some new and obscure looking app in tell us in the comments if you found something. You can also send us a screenshot of your apps.
Try clearin your browser cache. Go to settings > apps > all, find the browser you are using and first tap on Force Stop, then Clear Data and Clear Cache. Do the same for all browsers. If this does not help, write to us in the comments for further support.
Thanks so much!!! Been trying to remove it with several malware removal softwares but they didn’t do anything. I finally removed the malware using these steps without SpyHunter.
I think this would be a likely virus in the registry: {DAF8B7E5-449D-4180-8281-10E536E597F2}
Just trying to confirm…
Yes, this is likely a registry key created by an unwanted program. However, before you do anything, could you sen dus a screenshot of your Registry for re-assurance?