Google warns users infected with DNSChanger malware, provides help

By on May 25, 2012, 5:30 PM

Google has begun providing a warning to visitors who appear to be infected with DNSChanger, a malware which attempts to redirect users to various websites by modifying their DNS settings. The notification is a highly visible alert which tells the user they are infected and links to instructions for removing DNSChanger. 

In February, we reported that over 4 million computers were infected with the bug.

Google's initiative is spurred by the expiration of a court order on July 9. Once the court order ends, there will be no obligation for the Internet Systems Consortium to maintain temporary DNS servers which allow users infected with DNSChanger to remain online. With the shutdown of DNSChanger's infrastructure and the discontinuation of those temporary servers, infected users will have invalid DNS settings -- a problem which effectively results in no Internet access. To understand this though, you need to also understand a little bit about how DNS and DNSChanger works. 

In really basic terms, DNS, or "domain name system" is an important service through which Internet domains (e.g. techspot.com) point web surfers to the correct websites and servers. Without DNS, the Internet would be a very unfriendly place.

When a computer is infected with DNSChanger, the malware modifies the PC in such a way that it bypasses bona fide DNS servers. Legitimate DNS settings are often provided by your ISP automatically, but can also be set manually -- and wrongly, at that. DNSChanger would then redirect that user's Internet traffic through its own DNS servers. From then on, as an infected user cruises the web, the malware's rogue servers would deceptively redirect that person to advertisements, illicit or dangerous material and spy on them without their knowledge.

Particularly dangerous was DNSChanger's ability to also change DNS settings on routers, effectively spreading the issue from a local computer to an entire network. For some users, even after their computers are malware-free, issues will persist until they remove the harmful changes made to their router.

It is interesting to note that Google performed a similar service last summer, in order to protect its users from an unrelated DNS-based malware attack.

Users can check if they are infected with DNSChanger here and may remove the malware by following these instructions.




User Comments: 12

Got something to say? Post a comment
Trillionsin Trillionsin said:

This sounds like a good thing... kick users offline and they will do something about it and clean out their computers.

I really think that identity protection and online security should start to be taught in elementary school, and then more extensively as the grade levels go.

H3llion H3llion, TechSpot Paladin, said:

<p>This sounds like a good thing... kick users offline and they will do something about it and clean out their computers. </p>

<p><br /></p>

<p>I really think that identity protection and online security should start to be taught in elementary school, and then more extensively as the grade levels go.</p>

Yep, now if more warnings would be triggered for other problems / keyloggers and trojans. That said, if it spots false positives then it sucks heh ^^ Unless there is a way to ignore the warning or something.

Guest said:

Yep tootaly agree with the user stateing that malware and anti virus should be tought in grade school the same way they should be tought to be nijas instead of drawing up laws to start executing people for these crimes instead of handing them out jobs.

Guest said:

Maybe we should just ask our schools to raise our kids.

Guest said:

Never truly understood why they ran temporary servers to keep infected folk online in the first place. Keeping a personal computer clean is an individual's own responsibility, so why should someone else pay to protect them from their own negligence.

It's like maintaining a car. You either change the oil yourself or you pay a shop/mechanic to keep it in safe running condition...nobody else pays to keep your personal vehicle on the road.

Trillionsin Trillionsin said:

<p>Maybe we should just ask our schools to raise our kids.</p>

Lets face it, they do anyways. Most parents are oblivious to what their kids really need anyways, and let the schools do most of the work. Not only that, but the older generations know nothing about computers let alone how to protect your identity online, and just general computer security in the first place.

I suppose this current generation will know more, and be more capable of this. I know that there will always be exceptions to everything I just said here, this is mere opinion based.

pretty sure guests are just doing what they do best anyways... I should just ignore them.

3DCGMODELER 3DCGMODELER said:

kewl

I want the bug

kewl

hahaha

hehehe

Guest said:

ok I Went and used the Macscan(only one for Mac) used their free download. Problem seemed to be cured, but now it says it's back. "free" is over and it will cost me 40 bucks to download MacScan again!!? is this right? is there another program for Macs?

does not seem Macs are as free of viruses as Apple would like us to believe.

crabman1982 said:

is this some joke to get you to mess up your system if I have the problem it would not be my falt and my virus protector should pick it up

Staff
Rick Rick, TechSpot Staff, said:

<p>is this some joke to get you to mess up your system if I have the problem it would not be my falt and my virus protector should pick it up</p>

Huh?

Guest said:

Advertisers pay to present their goods and services. If the public, even the infected, not too web-wise portion of the public, cant view the ads because their computer is down.... (finish the sentence yourself).

Guest said:

huh? I was thinking same thing....with your lack of response

Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.