Users warned of internet blackout over DNSChanger virus

DUBAI // Thousands of internet users whose computers have been infected by a virus could have their web access blocked from today.

DNSChanger has been spreading through hundreds of thousands of computers worldwide since 2007.

The software changes an infected computer's settings so that it is forced to use illegal servers that redirect users to fake websites, which seek to steal personal information.

Google launched an awareness campaign in May urging people to check if their computer was affected.

"Google has rolled out a program to notify people when it detects that their computer is trying to reach those temporary DNS servers," said Cameron Camp, a security researcher with the internet security firm ESET, in his blog. "If you use Google search, that will trigger the detection process and a message will appear saying that 'you might be infected', if Google detects those temporary DNS servers."

The Domain Name System (DNS) turns web address names into numbers, allowing computers to send traffic to the right place.

The malware alters DNS settings, resulting in users being sent to malicious servers that redirect people to harmful sites. The virus also changes settings on home routers that, in turn, can infect other computers and mobile devices.

Officers from the FBI and Estonian police arrested a group of people in connection with the DNSChanger in November.

Control of the illegal DNS servers was transferred by the agencies to the Internet Systems Consortium, a non-profit group that devises and maintains internet protocols.

Since then, internet service providers and other groups have been trying to alert victims.

Because the virus attracted so much traffic, the FBI was able to obtain a court order permitting it to use replacement servers, allowing traffic to flow normally even for infected servers. But that order expires today and experts say about 300,000 computers are still infected worldwide.

According to the DNS Changer Working Group, which is made up of various technology companies and was set up to monitor the servers, about 69,000 computers are infected in the US alone.

"Reaching victims is a very hard problem, and something we have had issues with for years," said Johannes Ullrich, a researcher with the SANS Security Institute

But he added that he expected the impact to be "minimal" because many of these systems are no longer used or maintained.

For more details and to check if your computer is affected, visit www.dcwg.org

nhanif@thenational.ae