DNSChanger Malware Set to Knock Thousands Off Internet on Monday

SOURCE: PC World

Thousands of PCs worldwide may be unable to access the Internet beginning July 9 unless those machines are rid of the pernicious DNSChanger malware that first surfaced in 2007. The Federal Bureau of Investigation helped shut down the criminal ring responsible for DNSChanger in late 2011. The federal agency then briefly handled the Internet Domain Name System routing for all infected Mac and Windows systems.

Since early 2012, the Internet Systems Consortium, a nonprofit corporation, took over DNS routing responsibilities from the FBI. But that courtesy is coming to an end Monday, and if your computer is one of the thousands still infected, you need to fix your machine so you can keep getting online.

What did DNSChanger Do?

DNSChanger rerouted infected computers through servers controlled by a criminal ring based in Eastern Europe. The malware did this by taking advantage of the Internet’s Domain Name System (DNS) service. Think of DNS servers like phone books for the Internet. These servers turn the plain text Web address that you enter into your browser, such as PCWorld.com, into a string of numbers. These numbers are known as Internet Protocol addresses (PCWorld’s is 70.42.185.10) and computers use them to connect to one another and get around the Internet. IPs are assigned to home and business Internet connections and every website you visit.

It should be pretty clear that DNS is not something you want to have intercepted by criminals. Any time they want, criminals who control how your computer uses DNS can do malicious things such as reroute your computer to fraudulent websites. Once there, the sites can try to download more malware to your computer or attempt to harvest data such as login credentials.

DNS changing was only one of the malware’s functions, according to the DNSChanger Working Group, a consortium of companies, universities and other institutions helping to deal with the impact of DNSChanger. The group says it’s also possible DNSChanger could have also been capturing keystrokes (known as keylogging).

As of June 11, the group detected DNSChanger infections from more than 300,000 unique Internet Protocol Addresses worldwide. Nearly 70,000 of those unique IPs originated in the United States. An Internet Protocol address counts as one main connection to the Internet, but can include multiple PCs behind one IP.

How to Know if You’re Infected

If your computer is infected with DNSChanger and you’ve recently visited Facebook or Google, then you’ve probably seen warnings about your system being infected with DNSChanger. Both services are posting notices to systems infected with DNSChanger and offering advice about what to do about the infection. Your Internet Service Provider may have also notified you about an infection.

What to Do if You’re Infected

If you’ve determined that your PC is running DNSChanger malware, there are several things you can do. The DNSChanger Working Group has a list of free removal tools from major computer security firms including Kaspersky, McAfee, MacScan, Symantec and Trend Micro, as well as a Microsoft tool.

Before you use any of these tools, you need to backup your personal files. The DNSChanger Working Group also suggests that infected users might be better off switching to a new PC if they were already thinking of upgrading their current system.

Another option, and perhaps the safest bet if you’re sticking with your current PC, is to backup your files, reformat your hard drive and reinstall your OS. Check out PCWorld’s guide to reinstalling Windows for more information.

If you determine that your router is infected, contact your Internet Service Provider for help.

DNSChanger may not be that widespread anymore (this year infections were detected at half of all Fortune 500 companies). But if you’ve got DNSChanger on your system, you have to deal with it this weekend before the Internet goes dark for you Monday.