FBI Warn DNSChanger Could Knock Half a Million Offline

News Article - Tuesday, 24 April 2012 11:48

By: Kerry Butters Category: Security

The FBI has warned that as many as half a million PC users could find themselves knocked offline on July 9th if they are still infected with the DNSChanger malware. Whilst the cyber-criminals responsible for distributing viruses which altered DNS last year, a replacement DNS service set up by the FBI is due to expire on July 9th.

This means that infected machines will then be routed back through the DNS changing servers, which are located in Estonia. The criminals responsible operated under the company name of ‘Rove Digital’ and distributed various malicious programs such as TDSS, Alureon, TidServ and TDL4.

The rogue servers have been taken out of operation by the FBI but many users remain infected with the DNSChanger trojan which means that when the machine attempts to look up DNS after July 9th, they will not be able to resolve DNS and will be faced with a ‘page not found’ error.

The servers were originally set up to distribute an affiliate system and it’s thought that cyber-criminals pockets millions of dollars in fees whilst the system was active. When the FBI arrested the perpetrators in November last year they also set up a workaround to ensure that new servers were put in place to route affected machines.

This was carried out by obtaining and then gaining an extension on a court order, which runs out in July. However, the good news is that it’s a simple matter to find out if a machine is affected and clean it. A number of sites have popped up to quickly tell a visitor if they are infected and what they can do about it and the FBI also has a form on their site, as well as instructions for removal.

Recent Articles