DNS Unlocker Virus

This article helps with the DNS Unlocker “Virus” removal from Chrome, Firefox, IE and Android phones. If a DNS Unlocker removal tool is what you are looking for, we can help you with that as well.

DNS Unlocker Virus

Remove Ads by DNS Unlocker

DNS Unlocker removal tool is a program known to belong to the well-known adware class. It is marketed as supposedly being able to grant you access to blocked websites and digital media, free of charge. Unfortunately it does not deliver. As you can tell from its name, that’s not quite the point of adware programs, merely the pretense of their legality. This type of software is designed for all of the most popular Internet browsers (Chrome, Mozilla, Internet Explorer) and has been well documented to induce numerous advertisements in the form of pop-up windows and browser redirects such as my quick converter, layers of banners and random in-text links on pages, where they normally aren’t present. We strongly advise you against clicking on any of these ads, because it is very common for them to sometimes be fake or just pose a clever ruse for the user to be tricked into clicking on the specific pop-up or link. Once this happens you will in many cases be redirected to shady websites and prompted to install different types of software under the pretense of missing “codecs”, different program updates, anti-virus programs or tools to deal with a “detected” threat. These are exactly the types of things that would have you end up in a situation where a DNS Unlocker removal is unavoidable. You can see another prime example of this type of software in our Zeus Virus Detected instructions.

All that being said, however, please note that adware is not to be confused with a virus or other type of malware (‘malicious’ + ‘software’ = malware). It is an annoying piece of programming, but it will not directly harm your computer or the data stored on it. Specialists like to refer to these types of things as potentially unwanted programs or PUP.

One of the reasons why DNS Unlocker would be potentially unwanted was described above, but there’s also another, no less important reason for you to consider ridding yourself of this parasite as quickly as you can. Adware is notorious for collecting you browsing related information, since it needs to optimize the content of the ads and make it more appealing to you. This information, which might include your geolocation, IP address, favorite sites, search queries and even personal details you’ve entered somewhere, is stored, analyzed and quite likely sold to third parties. We assume you can extrapolate the dangers of there being cyber criminals among these third parties and what that could result in, should your data land in their hands. So even though DNS unlocker is not a virus you should strive to have it removed from your machine – the sooner, the better.

In addition to these more serious ways in which the DNS Unlocker “virus”can affect you, you could also expect to experience one or more of the following symptoms related to being infected by adware:

  • General slowdown of your PC;
  • Various system errors;
  • Possible gathering and installation of other adware.

When it comes to dealing with nuisances like the DNS Unlocker “virus”, understanding how it came to be on your PC in the first place is paramount. There are several ways this could have happened: Spam email is the first and most widely used method, but probably the least effective one. The second and by far the most lucrative one are freely distributed programs bundled with adware. These packages contain unwanted “extra content” that is firmly seated on the thin grey line between legal and illegal. You will typically find these on open-source download platforms or torrent websites. Once downloaded, a common mistake many people make (apart from not reading the EULA) is choosing the default setup settings. This is what enable the developers to stealthily include the bundled in adware, because you have technically already given your permission for that. So they end up having to deal with some DNS Unlocker removal problem. For this reason, we highly recommend choosing the advanced/custom settings for any such installation, because it will allow you to view what ‘complimentary’ programs have been included and give you the option of permitting or not permitting them to be installed as well.

An additional piece of information:

You may (or may not) encounter this Adware with a varying degree of other names, like powered by DNS, powered by DNSUnlocker, brought by DNS Unlocker, etc. The name doesn’t really matter. It’s all basically the same thing, so don’t be confused even if there are small differences. The DNS Unlocker “Virus” refers to the practice of advertisement platforms labeling their ads to increase their own renown. In reality it doesn’t mean anything. We’ve already had several people in the comments confused by this, so we wrote it down here to make matters clear. 


Name DNS Unlocker
Type Adware/Browser Hijacker hybrid
Danger Level Medium (DNS Unlocker can lead to additional programs, potentially even malicious ones, being installed on your computer)
Symptoms Small icons appearing in the ash-tray. Advertisements imposed on any browser pages. Sudden redirects to random websites.
Distribution Method Bundled with various types of free software, spam email and from online adverts
Detection Tool

DNS Unlocker Removal

To try and remove DNS Unlocker quickly you can try this:

  1. Go to your browser’s settings and select More Tools (or Add-ons, depending on your browser).
  2. Then click on the Extensions tab.
  3. Look for the DNS Unlocker extension (as well as any other unfamiliar ones).
  4. Remove DNS Unlocker by clicking on the Trash Bin icon next to its name.
  5. Confirm and get rid of DNS Unlocker and any other suspicious items.

If this does not work as described please follow our more detailed DNS Unlocker removal guide below.

If you have a Windows virus, continue with the guide below.

If you have a Mac virus, please use our How to remove Ads on Mac guide.

If you have an Android virus, please use our Android Malware Removal guide.

If you have an iPhone virus, please use our iPhone Virus Removal guide

DNS Unlocker Virus

Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).

DNS Unlocker Virus


Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab (the “Details” Tab on Win 8 and 10). Try to determine which processes are dangerous. 

DNS Unlocker Virus

Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
DNS Unlocker Virus
Drag and Drop File Here To Scan
DNS Unlocker Virus
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After you open their folder, end the processes that are infected, then delete their folders. 

    Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 

    DNS Unlocker Virus

    Hold together the Start Key and R. Type appwiz.cpl –> OK.

    DNS Unlocker Virus

    You are now in the Control Panel. Look for suspicious entries. Uninstall it/them.

    Type msconfig in the search field and hit enter. A window will pop-up:

    DNS Unlocker Virus

    Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

    DNS Unlocker Virus

    Hold the Start Key and R –  copy + paste the following and click OK:

    notepad %windir%/system32/Drivers/etc/hosts

    A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

    DNS Unlocker Virus

    If there are suspicious IPs below “Localhost” – write to us in the comments.

    Open the start menu and search for Network Connections (On Windows 10 you just write it after clicking the Windows button), press enter.

    1. Right-click on the Network Adapter you are using —> Properties —> Internet Protocol Version 4 (ICP/IP), click  Properties.
    2. The DNS line should be set to Obtain DNS server automatically. If it is not, set it yourself.
    3. Click on Advanced —> the DNS tab. Remove everything here (if there is something) —> OK.

    DNS Unlocker Virus

    DNS Unlocker Virus

    • After you complete this step, the threat will be gone from your browsers. Finish the next step as well or it may reappear on a system reboot.

    Right click on the browser’s shortcut —> Properties.

    NOTE: We are showing Google Chrome, but you can do this for Firefox and IE (or Edge).

    DNS Unlocker Virus

    Properties —–> Shortcut. In Target, remove everything after .exe.

    DNS Unlocker Virus

    DNS Unlocker Virus  Remove DNS Unlocker from Internet Explorer:

    Open IE, click  DNS Unlocker Virus —–> Manage Add-ons.

    DNS Unlocker Virus

    Find the threat —> Disable. Go to DNS Unlocker Virus —–> Internet Options —> change the URL to whatever you use (if hijacked) —> Apply.

    DNS Unlocker Virus Remove DNS Unlocker from Firefox:

    Open Firefoxclick  DNS Unlocker Virus  ——-> Add-ons —-> Extensions.

    DNS Unlocker Virus

    Find the adware/malware —> Remove.
    DNS Unlocker VirusRemove DNS Unlocker from Chrome:

    Close Chrome. Navigate to:

     C:/Users/!!!!USER NAME!!!!/AppData/Local/Google/Chrome/User Data. There is a Folder called “Default” inside:

    DNS Unlocker Virus

    Rename it to Backup Default. Restart Chrome.

    DNS Unlocker Virus

    Type Regedit in the windows search field and press Enter.

    Inside, press CTRL and F together and type the threat’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

    • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
      HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
      HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

    If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!

    Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
    More information about SpyHunter and steps to uninstall.


    About the author


    Bert L. Jackson

    Bert L. Jackson has more then 13 years in the Cyber Security Industry consulting and collaborating. Distinguished for an entrepreneurial mindset, creative problem solving, cross-functional teams and a bottom-line orientation.


    • Please help, i’ve tried everything and can not remove it, DNS lookup and coupoon keep spamming me and make my webpages run slower.

      • First questions: What browser(s) are you using? Also, Is Ads by DNS Unlocker present in the browsers or you can’t locate it this way?

    • This tutorial works awesome but you still need to add one more thing to it! I followed your tutorial and at the end, I was still stuck with some kind of app that was causing my google chrome to populate coupon on every page I would visit! After investigating, I found out that the damn “DNS Unlocker” had modified my DNS settings! After fixing this I was completely good! I have google chrome, so I am unsure if this fix persist to other browsers.

      The path to do this follows:

      Control Panel > Network and Internet > Network and Sharing Center > Change Adapter Settings > Right-click your active internet connection (usually Wi-Fi since everyone uses that, unless your using a desktop) and click properties > Now under the Networking tab, scroll down until you find Internet Protocol Version 4 (TCP/IPv4) > Highlight that then click on properties > Both options in this windows should be automatic! The first option should be set to “Obtain an IP address automatically” and the second should be set to “Obtain DNS server address automatically!” If your computer belongs to a company or you actually have a custom DNS then this would not apply to you. Once you are finish, click “OK” and close the windows > Now go back into Chrome and reset your settings one more time and boom! It should work just fine.

      • Thank you for the information! It’s very helpful. I’ll add it to the DNS Unlocker removal guide immediately.

    • I followed all of this and the virus is still showing up on google chrome. Do you have any further tips? I appreciate all of your help.

    • In the hosts file in step 4, after local host it says “start of entries inserted by Spybot search and destroy” and after that I would estimate there are probably more than a thousand entries with the same IP address as local host. I uninstalled Spybot s&d but that did not change anything? What now? Thanks for your help

    • DNS was not listed as an extension on Chrome when I opened it, but it’s definitely on my computer. I had local host in that text file as well. I went ahead and uninstalled it, but can’t find which processes running are DNS. Please help!

    • For anyone asking: I clearly stated in the removal guide that if any step is not applicable for you, you should just skip it. These things change – they may be in your extensions – or not.
      I just updated the guide again. Hopefully now it will help you. This virus seems to change every few days and it’s hard to keep up with it.

          • I can’t find any information about these? Do you have any idea how these got there. My recommendation is to either install professional software that would scan your files for malware, or copy these adresses to a .txt file and delete them from your HOSTS file. See what happens then.
            Please, leave a comment to tell me what happened, I really want to help you 🙂

    • Hi i found an IP in step 4. When checking what programs had recently updated or been installed, only my McAfee was the one which had automatically updated without me physically doing it. Going back to step 4, under the localhost section in notepad i have got: mssplus.mcafee.com Any suggestions?

      • No, that’s perfectly fine. Mcafee shouldn’t have anything to do with DNS Unlocker. I was referring to possibly seeing a bunch of ips that have no designation, no mssplus.mcafee.com etc. This is OK. Go on with the guide – the updated last sections should do the trick if the rest fails.

    • Hi. I have had an attack with the dnsunlocker virus. Having meticulously followed the instructions above I noticed that when I go to manage add ons to disable dnsunlocker there is no such extension. Am I missing something here.
      Thanks for the tutorial.

      • No, you’re doing everything fine. DNS Unlockerk just changed – virus creators like to change their creations with time, so that removal guides like ours don’t work properly. there’s no way to know which “version” of the virus you have, so we listed everything needed to get rid of it. Just move on to the next step and you’ll be fine. But make sure to cover all the steps even if you don’t see it. There’s always a chance you may miss something.

    • Hi, I’ve had the DNS Unlocker problem from a couple of days ago, and am using the Safari browser on a MacBook Pro. May I know what steps I should take? I’ve already tried looking for browser extensions, but there were none. Thank you!

      • Try everything disclosed in the guide first. We updated it recently (check the last 2 steps of the PC guide). If nothing there works, leave another comment and I’ll try to help you in another way.

    • The only thing that has installed onto my computer in the last week are Microsoft updates, so it’s obviously attached itself to them somehow. I can’t get rid of it at all and it re-installs every time you restart the PC. That’s yet another PC knackered by people who have nothing better to do.

      • If it reinstalls itself on reboot, your DNS Unlocker removal should definitely be 100% about regedit. See the updated parts in the guide – you must be missing something. If you can’t do it, leave another comment for me and I’ll assist ou 🙂

    • Hi there, I am 13 and I have recently encountered DNS Unlocker and I’ve always uninstalled it at the ‘Uninstall a Program’ section. My PC ran fine until a few months DNS Unlocker comes back, and it does not show up at the Uninstall a Program section, neither is it also at the Extensions section on my Chrome browser, it’s the browser that I use a lot often. Please help!

      • Did you cover all of the steps described here, particularly the last 3 steps?
        It’s not a problem if DNS Unlocker doesn’t show up in Chrome or the Control Panel. Just move along and continue with the guide. There are different versions of the virus, and some show up in the control panel & the extensions, but others don’t. There’s no way to know which version yuo got exactly. Don’t hesitate to ask other questions.
        I advise you to just complete the guide, and if it’s not gone when you finish, ask me and I’ll give you pointers 🙂

    • I have had this virus sneaking around my computer for months now. I’ve been following the guide so far and have found many files and folders whose names are comprised of nothing but random numbers and/or letters littered all throughout my Registry, Program Files, Program Files (x86), ProgramData, AppDataLocal, Extensions, etc. I have no Idea whether or not I should delete any of these files or folders since they give no information as to what they actually are or do. A decent amount of these folders have files with the type name “YYoutouubeAdBlocKe”, sorry the only screenshot I took of that is in the Temp folder. (I had the AdBlock Plus extension for google for a while, but I don’t think that’s the type name used by that extension. Also the vast majority of the files with that type name come back after shortly after being deleted.) I didn’t take screenshots of each and every one of the Folders/Files mentioned above, just some to provide examples. I also have AdAlert and Bueno Search Toolbar plaguing Chrome (I’ve never had any ad spam related problems with Bueno Search. I can usually just remove the extension and it won’t bother me again, but the extension always comes back after resetting chrome and removing whatever profile is active at the time from Users), and some extension named Best Save For You on IE (I haven’t used IE once ever on this computer either. I found out about that extension when following this guide.) I followed the guide as best I could and it didn’t help at all. Could this all be fixed by simply restoring the computer to Factory Settings or by doing a Factory Restore to a much earlier date? I am completely fine with losing all my data if it means this garbage will be gone.

      • I suggest you use SpyHunter’s scanner. It can point you in the direction of the infected files. If you have difficulties, I’l help you remove them myself.
        A factory reset works almost 100% of the time. You should not have any trouble after a factory reset.

    • Hello all,
      If you still cannot get rid of DNS Unlocker even after following all the 8 steps, try this out.
      1. Go to network connections.
      2. Internet protocol version 4.
      3. Select “Obtain DNS server address automatically” radio button.
      4. Click on “Advanced”, “DNS” tab.
      5. Remove any entry in “DNS server addresses, in order of use.”

      Problemo solved !!!!

      PS: Step 3 would give you a solution in most of the cases.

      Happy browsing.

    • 1.The only I am unable to follow is Step 7 (Updated !), I can’t do anything other than install it.
      2.I’m confused on what Step 3 is trying to tell me; either to actually remove everything or type (remove everything here) after .exe

      3.Another problem is after using this guide DNSUnlocker has gotten significantly worse and that it’s still on the computer.

    • Hey. I got to the final step in the update and it says it cannot delete some of the Temp files because they are either open in Adobe or in the COM Surrogate. What does that mean and how can I fix it?

      • Hello, Breanna. You might try to copy the whole folder on another partition and try to edit it and then replace the existing one with the edited files. If the problem still persists, we suggest you download the software listed in the article above and use the free scan function to locate your problem files. Let us know how this goes.

    • HI,

      I have made every step, but though DNS Unlocker is still on my computer… What can I do?

      At step , I have this:

      # localhost name resolution is handled within DNS itself.

      # localhost

      # ::1 localhost

      Thank you very much for the help


    • Hi, I was just wondering, will a PC reset work in removing this? Up until this morning when I opened my computer the adware hadn’t installed itself and everything I needed backed up was already saved to an external drive. Just to be safe I went ahead and decided to reset my PC and wipe all the files, programs and drivers. It’s just short of a full factory reset, so this way the files are gone but the OS (Windows 10) and the programs pre-installed on the computer when I got it will be reinstalled upon reset.

      Long story short: should this get rid of the DNS Unlocker? Unfortunately it’s not my first time it’s happened and I’m pretty careful about what I install since it happened the first time. So I figured that a full reset would probably work. In the event it doesn’t work, would you suggest I try going through the steps here again, or would you suggest a full factory reset?

      • Hello Donovan,
        In theory what you are describing should work. If the problem reappears we would recommend going through the steps again and considering installing the software from the article above, the scan function is free and can at least pinpoint your problem files. A full factory reset should be a last resort solution.

    • This actually worked!! I had to find it manually in regedit with ctrl + f “dns” and I’m so glad it’s finally gone! Thank you!

    • The steps above got rid of it for me!! Thank you so much!! I will look to you first for help with any viruses. I went through three other extremely long and time consuming processes that did not work. You’re now in my Favorites!

      • Hello Monika,

        You’d better delete them from your hosts file, they indeed look quite suspicious, you can save them to a .txt file first though, just in case something goes wrong, you can add them again manually.
        Let us know afterwards how that goes for you.

    • Hello again monika. Don’t worry, you are not bothering us 🙂
      Download the scanner from one of our advertisements. It should point you towards any infected files you might have missed. I’m willing to bet there’s something in regedit you didn’t see. Try with the scanner and tell us how it went.

    • Thanks you a lot, I’ve been searching through a lot of guides and this one is the best by far. At least I’ve got rid off that shitty adware.

    • Hi Varun,

      These settings are OK, this file is safe and the problem lies elsewhere.

      Can you open the network settings of your adapter and tell me if any changes have been made to the ICP4/IP protocol?

    • Hi Meg,

      This line is added if you had (or currently have) Mcafee installed on your PC. It helps it load updates. Feel free to remove it if you want.

    • Hi Steven,

      Please open the network connections (should be a computer icon on your task bar)-> network and sharing for Windows 10. Select the adapter by clicking on the line after Connections, click on properties, click on the IP4 protocol, click on properties.

      Do you have any numbers in the fields there?

    • Hi Kirstie, can you do the following:

      Please open the network connections (should be a computer icon on your task bar)-> network and sharing for Windows 10. Select the adapter by clicking on the line after Connections, click on properties, click on the IP4 protocol, click on properties.

      Do you have any numbers in those fields?

    • Hi,

      Can you go to your network adapter, press properties, then select IP4 from the list and click on properties again. Do you see any numbers written in the DNS field?

    • Hi, you need to delete these lines from the hosts file, then save it afterwards. If that doesn’t work do the following:

      Search for Notepad in windows search, right click on it and select Run as admin. When the program runs use the inside “Open” menu to open the hosts file and delete the lines.

    • Hi Vikki, what you need to do is simply delete those lines from the file, then save it. If you don’t get permission to do that first run Notepad as an admin (search for notepad in windows search,, right click on exe-> run as admin) and then open the Hosts file from the inside menu of Notepad: File->Open.

      • Hi Cassandra,

        You likely have an illegal copy of McAfee installed, that’s what the last line is about. All other lines related to chineese sites should be deleted.

    • Did you try Spyhunter, the scanner from one of our ads. The paid version is for automatic removal. The scanner is free, so just use it to help you find the infected files, then use our guide in conjunction with it.
      Did that help you? Tell me if it doesn’t, in the meanwhile I’ll try to think of another way to resolve your situation 🙂

    • Hi Lyle, thanks for the feedback. That’s why downloading codecs from un-trusty sources is a really bad idea.

    • Hi there, just delete them from the file. If you are not able to save the file afterwards do the following:

      Do a Windows search for Notepad.
      Right-click on the executable that comes as the search result -> Run as administrator
      When notepad opens press File->Open and navigate to the hosts file in the windir/system32/Drivers/etc/ directory

      You should be now able to save the file after deleting the IPs.

    • These are definitely part of DNS Unlocker – or something else that was installed with it. Delete the lines from the file and save it.

    • Try downloading the scanner from one of our ads – it will help you find any leftover files you missed.
      Did this help? 🙂

      • I was reluctant to download anything more but did so as a last resort as my computer was basically unusable anyway. 86 issues detected, went through and deleted all that was found and now computer is as good as new. Thank you so much for this page!!

    • No. I recommend downloading the scanner from one of our ads, so you can find the adware files more easily.

    • Yes, using SpyHunter is definately the easiest way to do it. Otherwise you have to hunt them down manually.

    • I just typer in %temp% and hit enter. Do i delete just the files or everything that has come up e.g. .temp files and the random number and letter in bracket files, or just everything from the place i was sent. Thanks for the help in advance

      • Hello TehDracona, just to be clear of any possible confusion – which step are you referring to?

    • Hi Eimy,
      “when I click open and go to host files it says it’s empty”
      what do you mean exactly?
      you can’t locate/see the hosts file? Please elaborate so we can help you.

    • Hi Eimy,
      please give us more information about these IPs you are trying to remove, post them here or provide us with a screenshot, so we can know more about your issue.

    • Hi Breeana,
      that is because we are receiving a lot of Spam and the comments are moderated before posted on the site.

    • Hi Big guy,
      nobody wants any of these harmful contents. They just find their way in our system. Contact us if you need further help.

    • Hello, Please the malware infected my Android Device and I do share hot-spot to my PC since the virus infects Dns my PC is affected automatically too.

      Please can you give a procedure to remove the intrusive virus on my Android Device.

      • Hello, Pelumi. Try going to Settings > Applications on your Android device. Then go to the “All” section and look through the apps. See if there is some new and obscure looking app in tell us in the comments if you found something. You can also send us a screenshot of your apps.

    • Try clearin your browser cache. Go to settings > apps > all, find the browser you are using and first tap on Force Stop, then Clear Data and Clear Cache. Do the same for all browsers. If this does not help, write to us in the comments for further support.

    • Thanks so much!!! Been trying to remove it with several malware removal softwares but they didn’t do anything. I finally removed the malware using these steps without SpyHunter.

    • I think this would be a likely virus in the registry: {DAF8B7E5-449D-4180-8281-10E536E597F2}

      Just trying to confirm…

      • Yes, this is likely a registry key created by an unwanted program. However, before you do anything, could you sen dus a screenshot of your Registry for re-assurance?

    Leave a Comment