DNSChanger Malware Set to Knock Thousands Off Internet on Monday

PC World ^ | July 5, 2012 | Ian Paul

[yorkie]

Thousands of PCs worldwide may be unable to access the Internet beginning July 9 unless those machines are rid of the pernicious DNSChanger malware that first surfaced in 2007. The Federal Bureau of Investigation helped shut down the criminal ring responsible for DNSChanger in late 2011. The federal agency then briefly handled the Internet Domain Name System routing for all infected Mac and Windows systems.

[McGruff]

infected Mac

What? That's impossible.

[BenLurkin]

This thing smells to high heaven.

Internet providers and software designers have had 5 years to update definitions but haven't?

I don't believe it.

[yorkie]

It explains why, in the article, Ben. This is really nasty. It was also reported on FOX this morning.

[Currentriverrat]

Well I haven’t been able to get on the internet since that y2k thing.

[ShadowAce]

[mountainlion]

I went to the site to check my computer and they did not have anything for my junk Vista.

[Alas Babylon!]

If this happens, and you decide you can’t clean/fix your computer but still want to get to Free Republic despite the Slavic and Gypsy hackers reading all your data, add the addresses 209.157.64.200 and 209.157.64.201 to your HOSTs file (found on Windows machines in c:\windows\system32\drivers\etc). Be sure NOT to put a .txt or other file extension on this file.

;-)

[call meVeronica]

Ping

[yorkie]

Here is the link to click (for Malware check) from My Fox Phoenix - that was reported this morning.....

http://www.myfoxphoenix.com/story/17290699/seen-on-tv

[joe fonebone]

I was knocked off tuesday, but not by malware...

tornado, hail, rain and power outage is what got me..

can that be considered malware?

[yorkie]

Well, it looks like you got through it (hopefully safely)

[ZULU]

Incredible

[rarestia]

This thing smells to high heaven.

Internet providers and software designers have had 5 years to update definitions but haven't?

I don't believe it.

This malware actually redirects DNS. This isn't something that's avoidable if you're infected. It means that you're using bad DNS to get your addresses, even if it looks legit on the surface.

Most likely, unless someone got a hard copy of an anti-virus program or virus definitions, they'd never get legitimate fixes from the major AV providers.

[mrsmith]

To manually check Vista go to command prompt (it’s in accessories) and enter exactly ipconfig /all.
Chck if your DNS lists one of the bad ones.

The bad DNS’s are listed at the bottom of this page: http://www.dcwg.org/detect/checking-windows-7-for-infections/

[Linda Frances]

This virus has already hit my husband’s home and business (at our home) computers. Yesterday my IPAD kept disconnecting from our wireless because of the problems my husband was having on his main computer. He knows about this virus, but has not told me what he is going to do about it.

[JimRed]

Internet providers and software designers have had 5 years to update definitions but haven't?

Since they also own the companies that provide anti-virus software and "fixes" for the attacks, why should they? They create the virus then sell you a remedy. Do we really think that all that crap comes from acne blotched malcontents working in their moms' basements?

[publius911]

Bookmark

[FreedomOfExpression]

Well I haven’t been able to get on the internet since that y2k thing.

Don't worry about it. Besides FR, there are few places worth visiting. Mainly lots of freely accessible pornography.
BTW, are you logged in?

[Alter Kaker]

Can I catch the virus if I’m not logged in? I’m pretty sure I’m not.

[BlueLancer]

bookmarked

[yorkie]

"Can I catch the virus if I’m not logged in? I’m pretty sure I’m not"

Are you series?

[mountainlion]

Looks good. Thanks. Ain’t Vista Great!/s...

[martin_fierro]

"HEY! I BEEN THROWN OUTTA BETTER PLACES THAN THIS!"

[Cyman]

“Well I haven’t been able to get on the internet since that y2k thing”

Me too. But I haven’t complained because my microwave works so much better than it used to.

[joe fonebone]

Yeah, but, taking a line from Jaws..

I think I’m gonna need a bigger generator.....

I was not as prepared as I would have liked to be, but was far more prepared than most...

[oh8eleven]

Malware Set to Knock Thousands Off Internet on Monday
When it comes to anti-malware SW, there are few better than Malwarebytes Anti-Malware ... and it's free.
In fact, it just found and deleted two files on my PC that were infected with RootKit.ZeroAccess.

[BenLurkin]

If it redirects DNS then why wouldn’t it re-direct DNS away from the government website?

[RayChuang88]

If you have a Windows XP or later, download and install the current version of Microsoft Security Essentials, patch it with the latest malware definitions, and run a full system scan. This should remove the damage that DNSChanger has done to your system and ensure you won't be knocked off on July 9, 2012.

[BenLurkin]

Once the FBI shut down the operation, it built a safety net of new servers to redirect traffic from those infected with the virus.

Why would they do that? Is the FBI in the business of running Internet servers?

I guess I'm slow but I don't understand why anti-virus programs were just simply updated. If the problem is that you can't update definitions on line why hasn't the fix been on sale at Best Buy for the last 5 years?

[rarestia]

The men running this scam have been arrested, but many of the zombie computers are acting as DNS relays for the network they setup. No one is updating the DNS database any longer, so the new .org website isn’t in the catch list for them. As such, any one who has this should be able to go to this website without being re-directed.

Keep in mind, DNS is not all-inclusive. Corporations, governments, even the international registers can manipulate their DNS however they way. That’s all these scammers did. Once the malware was installed, all DNS was redirected to their servers by the malware, regardless of the DNS servers specified for the adapter.

It’s important to note this transcends operating system. This could be PC, Mac, or even Linux under the right conditions.

[yorkie]

WOW! You sure DID have a storm! (I wasn’t aware of it!)

http://www.wxyz.com/dpp/news/region/macomb_county/macomb-and-oakland-county-suffered-the-most-damage-after-bearing-the-brunt-of-the-storms

[rarestia]

MOST viruses come out of Russia and China nowadays. They're usually created to defraud individuals, re-route money from corporations, and generally bring down or infect anyone dumb enough to be running machines directly-connected to the Internet with no firewall or virus protection.

Unpatched PCs compromised in 20 minutes

You reformat your hard disk and install the OS with a direct connection to the Internet (no hardware firewall), and you're likely to be infected before you can even patch your machine. This is becoming more prevalent on PCs running Windows XP.

"Script kiddies" are those pimple-faced kids who run scripts they find on an anonymous FTP or IRC chat room. They're usually responsible for DDoS (Distributed Denial of Service), but the actual high-level, newer viruses are created by very devious, intelligent individuals.

[joe fonebone]

this is right where I live, I was in the middle of it.... i did not get flooded out, but by the time I got my generator running, the sump was filled right to the top... my neighbor was not so lucky... I gave him one of the outlets on my generator and he got his pumped out....

my power came back on late yesterday afternoon. but the fuses had blown out on my air conditioning. when I got into my car to go buy some, the outside temperature was 108 degrees....

[steve86]

. but the fuses had blown out on my air conditioning.

Because of low voltage initially I would suspect.

[joe fonebone]

low voltage... slow voltage... no voltage.... hell, it is so damn old that all I have to do is stare at it real hard and the fuses blow..

It is so old that it uses freon, the real stuff...

22 years old and still pumping out more cold air than any of the new ones..

when I bought it, the expert told me I needed a 2 ton unit for my house, I told him to install a 5 ton unit.

I hardly has to work to turn my house into a refrigerator..

[zeugma]

This would have been easily fixable quite some time ago by either the ISP or FBI. At the ISP level, all they’d have to do is have a NAT in place so that any request for the known bad DNS servers would go to a DNS server that would serve whatever the ISP wanted. The ISP could then direct all traffic from infected computers to a website that tells them they are infected, and how to fix it. This isn’t rocket science folks, and could have been put in place years ago at almost no cost to the ISP. Of course, they’d actually have to give a damn about their customers.

[Zetman]

ping....

(Or, perhaps more appropriately - nslookup....).

[onedoug]

What does M say about this?

007

[freebird5850]

bump for later!

[ncpatriot]

This is what my ISP sent me back in May:

Users of Windows PC and Macs alike have until July 9, 2012, to check and see if they’ve been infected with malware called DNS Changer and, if so, disinfect their computers. After that, the FBI will throw a switch that prevents infected computers from accessing the Internet.

What’s going on here? It all began 2007, when DNS Changer surfaced and infected millions of machines. (To give you some background, the DNS system is a network of servers that translates a website address into the numerical addresses that computers use.) DNS Changer reprogrammed victim computers to use rogue DNS servers owned by the attackers. This allowed the attackers to redirect computers to hacker-created websites, and also prevented computers from updating or using anti-virus software, leaving them vulnerable to other threats.)

Last November, the FBI arrested six Estonian nationals that allegedly ran the fraud, and seized the rogue DNS servers. The FBI put up surrogate servers in place of the malicious ones, but only temporarily. After July 9, those servers will shut down, preventing infected computers from reaching the Internet since they’ll be trying to redirect through servers that no longer exist.

To find out if your computer is infected and how to address the problem, visit https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS and click on “Check Your DNS.” Also be sure to update and run your current security software. If you need assistance, please contact us for security software recommendations.

You’ll find additional information on DNS Changer at these links:
www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf
www.foxnews.com/scitech/2012/04/23/hundreds-thousands-may-lose-internet-in-july
www.usatoday.com/tech/news/story/2012-04-20/internet-woes-infected-pcs/54446044/1?csp=hf

[malia]

bump

[piroque]

mark’d for later,,, thanks

[Liberty Valance]

http://www.dcwg.org/
This is the site set up by the fbi for help.

[musicman]

bookmark

[rickyc]

I see nothing for IOS 5.1.1 or IPad, Iphone, etc. Any word on that?

[rickyc]

I see nothing for IOS 5.1.1 or IPad, Iphone, etc. Any word on that?

[freeperkiki]

I see nothing for IOS 5.1.1 or IPad, Iphone, etc. Any word on that?

Great catch...and good question. I'm not comfortable going to ANY site, especially government run, to check my computer out. From everything I've read, if you have a good firewall and anti-virus protection, you're probably good. Also, not doing boneheaded things like signing up for “you've won a such and such” should keep you in the clear.

Personally, I am with a lot of other folks who believe this is a load of crap with a dash of nefarious added.