Some users could lose Internet

Published 12:04 am Saturday, July 7, 2012

 

 

Despite repeated alerts, tens of thousands of Americans may still lose their Internet service Monday unless they do a quick check of their computers for malware that could have taken over their machines more than a year ago.

The Federal Bureau of Investigation will shut down Internet servers that it temporarily set up to support those affected by malicious software, called DNSChanger. Turning off those servers will knock all those still infected offline.

Locally, Madison Copeland of Copeland Computer Solutions, said the majority of Andalusians probably don’t have anything to worry about.

“We haven’t seen anyone with it here that we know of,” he said.

Over the past five years, a group of six Estonian cybercriminals infected about 4 million computers around the world with DNSChanger. The malware redirected infected users’ Web searches to spoofed sites with malicious advertisements.

So how did this all happen?

The servers set up by the cybercriminals redirected search traffic to their own rogue servers, bypassing Google, Microsoft’s Bing or other search engines’ servers. Users would be shown fake search results that sent them to spoofed websites with manipulated online ads.

For example, when a user searched for Netflix and clicked on the fake search result, he or she would instead be redirected to an unrelated website called “BudgetMatch.” If a user searched for ESPN and clicked through, DNSChanger would replace Dr. Pepper 10 ads on ESPN’s website with an ad for a timeshare business.

The fraudsters made $14 million through those illegal ads, the FBI said.

The malware also prevented users from updating their operating systems or anti-virus software, which may have detected the virus.

Facebook and Google joined the awareness efforts by alerting users whose devices appear to be infected. Both sites display warnings and provide links to help get rid of the malware.

According to the FBI, the number of computers that probably are infected is more than 277,000 worldwide, down from about 360,000 in April. About 64,000 still-infected computers are probably in the United States.

In November 2011, the FBI and some overseas partners arrested those responsible, commandeered their servers, and attempted to warn those affected to get rid of the virus.

The FBI did not immediately take down the rogue servers, as infected computers would have lost Internet access, an FBI spokesman said.

To remedy the problem, the FBI had the nonprofit Internet Systems Consortium set up temporary servers. That way, computer owners would have time to get rid of their malware.

The servers were supposed to be shut down in March, but hundreds of thousands remained infected. The FBI decided to give people even more time to check for the malware, extending the deadline until July. The agency now says the time has come to cut the cord, and the emergency servers will be shut down on Monday.

Though the FBI tried to send notifications to those infected, it could not identify all of them, a spokesman said.

To check whether a computer is infected, users can visit a website run by the group brought in by the FBI: http://www.dcwg.org.

The site includes links to respected commercial sites that will run a quick check on the computer, and it also lays out detailed instructions if users want to actually check the computer themselves.

Another website Robert Copeland, also of Copeland Computer Solutions, recommends is dns-ok.lu.

“I think that the government has it pretty well-tracked so that they know exactly who is infected,” Madison Copeland said. “The website tests your DNS number, which is the ID number for your Internet connection. It will tell you if you are infected. It may take a minute for the site to come up because it is doing a scan.”

Copeland recommends that everyone have at least a free antivirus software and malware detection software to help prevent viruses and malware for invading one’s computer.

“Those are the best ways to check for it,” he said.