Internet service to be cut July 9

[SuperDave]

Thousands could loose internet service July 9. Full story here.

[Helpmeh]

The title is a little misleading...it's only for those who were infected with the virus, and didn't clean it up properly.

[overthehill]

The title is a little misleading...it's only for those who were infected with the virus, and didn't clean it up properly.

This is taken from the link provided;  Since November 2011, the number of computers still infected with DNSChanger has dropped substantially to 275,000 worldwide. In Canada, only about 7,000 machines are estimated to remain infected, as a result of efforts by the FBI and computer security companies to get users to follow instructions on how to check http://www.dns-ok.ca/ for and remove  http://www.dcwg.org/fix/ the virus.

So, if I'm free of infection at http://www.dns-ok.ca/ are there any other precautions that should be taken? Reading all the comments associated with this topic, almost made me dizzy.  overthehill

[evilfantasy]

I just got this in a news feed last night. First I had heard of it.

So, if I'm free of infection at http://www.dns-ok.ca/ are there any other precautions that should be taken?

If you visit the test site and it says you are clean then you should be fine. Google and Facebook have also been alerting users that may be infected when visiting their websites.

Although if you visit Computer Hope regularly then you are probably fine. Most of the regulars are above average users and know when something is wrong with our computers.

[overthehill]

I just got this in a news feed last night. First I had heard of it.

If you visit the test site and it says you are clean then you should be fine. Google and Facebook have also been alerting users that may be infected when visiting their websites.

Although if you visit Computer Hope regularly then you are probably fine. Most of the regulars are above average users and know when something is wrong with our computers.

Thanks evilfantasy. That's what I expected and wanted to hear.  I in fact wasn't that worried about me personally. Many of my contacts though; kids, relatives and friends etc. do not visit CH regularly and are not very proficient protecting themselves when it comes to the Internet etc. And, believe me it is not for my lack of trying. I'll certainly advise them though to visit the site to check for infection. Once again thanks, overthehill

[Geek-9pm]

It is simple to check your DNS
http://www.computerhope.com/forum/index.php/topic,131866.msg852949.html#msg852949

[Dr Jay]

I just got this in a news feed last night. First I had heard of it.

If you visit the test site and it says you are clean then you should be fine. Google and Facebook have also been alerting users that may be infected when visiting their websites.

Although if you visit Computer Hope regularly then you are probably fine. Most of the regulars are above average users and know when something is wrong with our computers.

That is fine to check with DNS-OK, but never assume it is effective enough. See the manual check just in case: http://www.dcwg.org/detect/#Manually_Checking_if_your_DNS_server_have_been_Changed

[Ryuk]

I never got any message from Facebook or anything.  Will this all so effect hand help devices?

[Geek-9pm]

Ryuk,

This is about the possible loss of service to many users who have the 'DNS changer' virus on their computers. Many people do not know they got the virus because the authorities turned the tables on the vandals.

The problem is really an old problem. It will have an effect on people who have not verified the DNS settings on their computers.

The DNS depends on where you live. You would want a service near you for best results. But the issue is to make sure it is a valid service.

[Ryuk]

I am aware of this just recently.  So it wont effect things like phones an everything? 

[Geek-9pm]

They are saying it is found only in PCs.
The threat is being over-hyped.
Here is just one of many 'Look-the-sky-is-falling' stories.
There Is No Excuse for Still Being Infected with DNSChanger
(He is one of the few who down plays the scare.)

By Tony Bradley, PCWorld
The FBI estimates that as many as 275,000 PCs are still at risk of losing access to the Web on Monday when it pulls the plug on the DNS servers it has maintained to redirect PCs compromised with the DNSChanger malware to legitimate websites. Seriously? How much warning do people need?...

So far nobody has wid it will be the end of the world...

[Dr Jay]

The problem is really an old problem. It will have an effect on people who have not verified the DNS settings on their computers.

The DNS depends on where you live. You would want a service near you for best results. But the issue is to make sure it is a valid service.

Who've not verified their DNS? More like for those that have not FIXED their DNS!

DNS depends on what ISP you have, or if you have changed it yourself. If viruses/malware have changed your DNS, it is your own problem not the ISP's problem. If you have elected to use Google DNS or OpenDNS, it is your business.

Therefore, for those infected with the rogue servers are considered zombies, in which will be deactivated of Internet access as of Monday! This is the attempt to stop the DNSChanger cybercriminals, to help track down and investigate them.

Whomever is keeping the DNSChanger botnet alive is being tracked down.

[Geek-9pm]

DragonMaster Jay,
For more about the Changer, do a Google.
Here is a good one:
http://www.pcmag.com/article2/0,2817,2406806,00.asp
That author says it can be in your router. Therefore the user wound NOT be be aware. Few ever look into the router settings to see if the router is doing an override of DNS requests.

Some routers allow remote access. In that case, a clever criminal could alter your router to hijack all DNS requests to another site.

I am not trying to scare people. I just want to point out the DNS Changer is more evil that you imagine.

[Dr Jay]

Yes, without being too specific, it usually causes router infections.

We have canned speeches that help remove these router infections. It was discovered over a year and a half ago.

Believe me, I've seen more evil malware than DNSChanger. It does not scare me.

Your router has been hacked by a malware author...aka hacker.

It has placed illegitimate DNS addresses in to the DNS servers boxes, making websites you go to check with these fake addresses first.

If the hacker chooses to do so, you will be redirected. I have to conclude that your router configuration has been hacked.

Routers can be hacked from inside the network, which means if there is malware on your computer, it can trace itself back to your router, log in to your router, and change settings.

These IP addresses:
-Static DNS 1: 213.109.64.7
-Static DNS 2: 213.109.72.139

are Russian IP addresses from a company called ProLite LTD. They have been the core issue of hacked routers on the Internet for a few months now.

What we need to do is a 30/30/30 reset for the router. It is a type of reset that will return it to firmware defaults....in other words...remove the malicious code from it and restores its original configuration.

You will need a paper clip, or something as small as a paper clip head (like a safety pin or needle).


While doing this, it may be appropriate to have someone help you, or be near the plug in for the router.

On the back of the router, there will be a reset button...use the pin/needle to hold down the reset button for 30 seconds...while you have the button held down unplug the router from the outlet...continue holding reset button for 30 seconds...plug the router back in and continue holding reset button for 30 more seconds. After that, release the reset button.

You router should recognize most types of configuration and you should be able to use it right away.

Re-set up your router as you did when you first got it. I know it is a time-based task, however, to defeat this infection, the router needs to be fully reset.

If you have done this all successfully, let me know. Test out the Internet and tell me of any redirects.

If you have any issues reconnecting the router, or getting it to work on your network, then do the following:

unplug the (usually yellow) Internet cable that is run from the modem to the router, and plug that cable directly in to your computer. You should be able to access the Internet from that temporarily so you can communicate with me.

Let me know how you got through all of this.

So far, from other hacked routers, they have been successfully reset, and the infection disappeared.

[Computer_Commando]

About 6 months ahead of time.