DNSChanger Malware Set to Knock Thousands Off Internet on Monday

Thousands of PCs worldwide may be unable to access the Internet beginning July 9 unless those machines are rid of the pernicious DNSChanger malware that first surfaced in 2007. The Federal Bureau of Investigation helped shut down the criminal ring responsible for DNSChanger in late 2011. The federal agency then briefly handled the Internet Domain Name System routing for all infected Mac and Windows systems.

Since early 2012, the Internet Systems Consortium, a nonprofit corporation, took over DNS routing responsibilities from the FBI. But that courtesy is coming to an end Monday, and if your computer is one of the thousands still infected, you need to fix your machine so you can keep getting online.

What did DNSChanger Do?

DNSChanger rerouted infected computers through servers controlled by a criminal ring based in Eastern Europe. The malware did this by taking advantage of the Internet’s Domain Name System (DNS) service. Think of DNS servers like phone books for the Internet. These servers turn the plain text Web address that you enter into your browser, such as PCWorld.com, into a string of numbers. These numbers are known as Internet Protocol addresses (PCWorld’s is 70.42.185.10) and computers use them to connect to one another and get around the Internet. IPs are assigned to home and business Internet connections and every website you visit.

It should be pretty clear that DNS is not something you want to have intercepted by criminals. Any time they want, criminals who control how your computer uses DNS can do malicious things such as reroute your computer to fraudulent websites. Once there, the sites can try to download more malware to your computer or attempt to harvest data such as login credentials.

DNS changing was only one of the malware’s functions, according to the DNSChanger Working Group, a consortium of companies, universities and other institutions helping to deal with the impact of DNSChanger. The group says it’s also possible DNSChanger could have been capturing keystrokes (known as keylogging).

As of June 11, the group detected DNSChanger infections from more than 300,000 unique Internet Protocol Addresses worldwide. Nearly 70,000 of those unique IPs originated in the United States. An Internet Protocol address counts as one main connection to the Internet, but can include multiple PCs behind one IP.

How to Know if You’re Infected

If your computer is infected with DNSChanger and you’ve recently visited Facebook or Google, then you’ve probably seen warnings about your system being infected with DNSChanger. Both services are posting notices to systems infected with DNSChanger and offering advice about what to do about the infection. Your Internet Service Provider may have also notified you about an infection.

Another way to find out if you’re infected is to visit one of several detection websites set-up by the DNSChanger Working Group. These sites will not require you to download any extra software or scan your hard drive. If you are infected, the site will be able to immediately detect it and notify you.

The bad news is that DNSChanger doesn’t just go after PCs, but can also infect your router. That means you may visit a malware detection site from any PC in your home and all will register as being infected even though your router is really the culprit.

If you want to be absolutely sure your computer is clean, you can check your PC’s DNS settings without relying on a third-party website. PCWorld’s tutorial “Protect Yourself From DNSChanger” has detailed instructions on how to do this for PCs and Macs.

What to Do if You’re Infected

If you’ve determined that your PC is running DNSChanger malware, there are several things you can do. The DNSChanger Working Group has a list of free removal tools from major computer security firms including Kaspersky, McAfee, MacScan, Symantec and Trend Micro, as well as a Microsoft tool.

Before you use any of these tools, you need to backup your personal files. The DNSChanger Working Group also suggests that infected users might be better off switching to a new PC if they were already thinking of upgrading their current system.

Another option, and perhaps the safest bet if you’re sticking with your current PC, is to backup your files, reformat your hard drive and reinstall your OS. Check out PCWorld’s guide to reinstalling Windows for more information.

If you determine that your router is infected, contact your Internet Service Provider for help.

DNSChanger infections are not as widespread as they were earlier this year when the malware was detected at half of all Fortune 500 companies. But if you’ve got DNSChanger on your system, you have to deal with it this weekend before the Internet goes dark for you Monday.

Connect with Ian Paul (@ianpaul) on Twitter andGoogle+, and with Today@PCWorld on Twitter for the latest tech news and analysis.