If you are one of the thousands of people whose computer was infected with the DNSChanger virus between 2007 and 2011 and you haven't yet bothered to remove it, chances are you're reading this at work or on a mobile device because your internet access has been cut off today.
Several temporary DNS servers that have been keeping virus-infected machines connected to the internet were shut down Monday as part of the winding down of the FBI operation Ghost Click.
Ghost Click was an international investigation that led to the arrest of a group of Estonian cybercriminals operating under the company name Rove Digital.
Between 2007 and 2011, the group successfully rerouted about 650,000 computers around the world through a system of false DNS servers, manipulating web searches and directing infected machines to fraudulent websites that promoted fake products, allowing the perpetrators to earn money off the sale of the products and advertising on the sites.
One example cited by the FBI was a website selling fraudulent Apple software to which users would be directed when clicking on the link for the official website for iTunes.
The investigation ended in November 2011, but the FBI contracted the non-profit Internet Systems Consortium to replace the rogue DNS servers with clean ones and keep them operating temporarily so that the infected computers connected to them would not lose internet access.
Those users who removed the virus from their computers had their normal internet connections restored, but those who didn't continued to be rerouted through the temporary servers instead of through their internet provider's servers — until today, July 9, when those servers were disconnected.
In Canada, about 7,000 machines were still infected with the virus as of June 2012, according to the FBI.
Unfortunately, those who lost their internet connection today have little choice but to take their machines to a computer expert and have the malware removed, since they will no longer be able to directly access the online services designed to detect or remove the virus.
Alternatively, you can go to an uninfected machine and try downloading some of the free DNSChanger virus scan and removal software compiled by the DNSChanger Working Group at www.dcwg.org/fix/ onto removable media, like a USB flash drive, and use that device to disinfect your computer.
A more extreme course of action would be to back up important data and wipe the hard drive clean and reformat it — or have this done by a computer technician.
Those who choose this route should keep in mind that if they don't back up files to a separate drive, they'll lose them, because reformatting cleans out all the files on a drive. The operating system and applications will also need to be reinstalled after reformatting.
If you are having trouble accessing the internet today and are reading this on another device, you can check whether your computer has been infected with DNSChanger by identifying your DNS settings and comparing them against the list of known rogue IP addresses listed on the FBI or Public Safety Canada websites.
According to those sites, if your IP address falls within one of the following groups, your computer is infected with the virus:
85.255.112.0 through 85.255.127.25
67.210.0.0 through 67.210.15.255
93.188.160.0 through 93.188.167.255
77.67.83.0 through 77.67.83.255
213.109.64.0 through 213.109.79.255
64.28.176.0 through 64.28.191.255
To find your DNS settings, Public Safety Canada recommends the following steps.
For Windows users:
Go to Start menu.
Select Run...
Type: cmd.exe [press ENTER].
Type in the black command window: ipconfig /all [press ENTER].
Search for the line that says "DNS Servers." Often, two or three IP addresses are listed.
Compare against list of rogue IP addresses.
For Apple users:
Go to System Preferences.
Select Network.
Select the connection used for internet access (typically, AirPort or ethernet).
Select Advanced.
Select the DNS tab.
Compare against list of rogue IP addresses.
No comments:
Post a Comment