DNSChanger malware causes internet blackout in over 42,000 computers

Infected US addresses lose connections to the internet as FBI's eight-month safety net against virus expires.

Early Monday morning, at least 40,000 computers infected with the DNSChanger malware lost their connection to the internet after the FBI shut down a temporary safety net for users connected to the infected servers.

DNSChanger malware alters the infected computer to prevent it from executing one of the most basic online functions. DNS (domain name system) servers translate an address, such as the guardiannews.com, to a numerical one, simplifying the web browsing process for the average computer user. Once the malware infects the host computer, users are redirected to fraudulent sites.

Going into this morning's shutdown, the FBI estimated that nearly 42,000 unique IP addresses in the US were still infected with the virus with an estimated 211,000 IP addresses globally affected. However, IP addresses are not equitable to individual people or computers, so the amount of users infected was likely much higher than those numbers suggest.

At the infection's peak, more than 575,000 IP addresses were infected with the DNSChanger malware. Yet court documents from November show that more than 4m computers worldwide were infected, at least 500,000 of which were in the US. This makes the number of people affected much more difficult to pin down, especially because they can't share their frustrations on the internet (unless of course they have internet access on their phones or have access to another uninfected machine).

Although the amount of infected computers are likely larger than reports suggest, the danger of the outbreak is not as serious as it seems.

Brian Krebs, investigative reporter at Krebsonsecurity.com, told the Guardian: "There are numerous similarly large outbreaks of malware and this one is by far the least threatening."

In fact, Krebs believes the internet shutdown is one of the best things to happen because it will take the infected computers off the internet, creating a cleaner online environment for everyone else.

Initially, the FBI safeguard was supposed to last 120 days, beginning in early November, but a court ordered a 120-day extension allowed the safeguards to remain in place until this morning. During that time, the FBI, Google, Facebook and internet service providers warned users of the impending shut down.

Spokespersons from Verizon and Comcast said they contacted infected users through a variety of methods including phone calls, letters and email. Internet service providers were able to find these users by cross-checking their curstomers IP addresses against a list of infected IP addresses provided by the FBI.

As of this morning, the outreach seemed to have helped. Charlie Douglas, a Comcast spokesman, told the Guardian: "Going into this, we believe far less than even one tenth of one percent of our remaining infected customers hadn't taken action."

The DNSChanger malware spread when a gang of cyberthieves operating under the name Rove Digital engaged in a sophisticated internet fraud scheme. Six members of the groups were arrested in November, one remains at large.

Can't get online and want to check if it's because your computer is infected with DNSChanger? CBCNews explains how to check your IP setting against the rogue IP addresses. If you lost your internet connection, call your internet service provider, who can instruct you in the best way to reconnect to the internet

 Source: guardian.co.uk