64,000 Computers May Lose Internet Monday Due to Malware

64,000 Computers May Lose Internet Monday Due to Malware
Nic Moye

1:37 p.m. EDT, July 5, 2012

More than 60,000 computers in the U.S. could lose internet access on Monday. More than a year ago, the FBI arrested several hackers who spread a malware called DNS Changer. In order to prevent a sudden disruption to more than half a million computers worldwide, the FBI put a safety net in place. Many people don't know their computers were affected. But the FBI will end its safety net at midnight July 9. Most computers are ok, but the FBI estimates about 64,000 users in the U.S. still have the virus on their computers.

In order to see if your computer is infected, you can click here.

It's a website that can tell you immediately if your comuter is ok. The website will be green if everything is fine. It will be red if there's a problem. If your computer is infected the website will tell you what to do.

Thousands of computer users may lose Internet access on Monday, when the deadline for a temporary fix to a malicious software scam shut down by the FBI last year expires.

What is it?

Millions of computers were infected with the so-called "Internet Doomsday" virus used in the hacking scam, which redirected Internet searches through DNS servers used by the scammers, who allegedly netted $14 million in bogus advertising revenue. After U.S. and Estonian authorities busted the malware ring last November, a federal judge ordered that the FBI use temporary servers while the malware victims' PCs were repaired. The temporary servers will shut down at 12:01 a.m. EDT on Monday, meaning anyone using a computer still infected with the virus will likely lose Internet access.

"Connectivity will be lost to the Internet PERIOD," Symantec, the online security firm, said in a blog post. "If your computer is still using DNS entries that are pointing to the FBI servers on July 9, you will lose TOTAL access to the Internet. No connecting to the office from home, no updating Facebook, nothing until the DNS settings are fixed."

How many computers have it?

It's unclear how widespread the "blackout" will be. According to a working group set up by security experts, more than 300,000 computers remained infected as of June 11, including 69,000 in the United States. Last week, 245,000 computers were said to be still infected with the so-called Alureon virus, according online security firm Deteque, including 45,355 machines in the United States.

Wired estimates 64,000 users in the United States and an additional 200,000 users outside the United States are still infected with the malware, "despite repeated warnings in the news, e-mail messages sent by ISPs and alerts posted by Google and Facebook." According to Internet Identity, another IT security firm, "12 percent of all Fortune 500 companies and four percent of "major" U.S. federal agencies are still infected with DNSChanger malware."

But it's unclear how many of those machines are still in use.

What you can do

According to Reuters, U.S. Internet providers including AT&T and Time Warner Cable "have made temporary arrangements so that their customers will be able to access the Internet using the address of the rogue DNS servers." And the problem, security experts say, is relatively easy to fix.

"It's a very easy one to fix," Gunter Ollmann, vice president of research for security company Damballa, told the news service. "There are plenty of tools available."

Online security firms, Facebook and the FBI are offering free diagnostic checks for users whose computers may be infected. Here are links to several:

• Malware check: http://dns-ok.us/

• FBI: https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS

• DNS Changer Working Group: http://www.dcwg.org/

• Facebook: https://www.facebook.com/notes/facebook-security/notifying-dnschanger-victims/10150833689760766

• McAfee: http://www.mcafee.com/dnscheck

Of course, that hasn't stopped local media outlets from breathless reporting on the looming "blackout."

"Monday morning," Alabama's WAAY-TV reported, "hundreds of thousands of Internet enthusiasts could wake up to find nothing but a dark, empty computer screen."

The hype over a potential "blackout" threatens "to obscure what has been a highly successful effort--one of few to date--to stamp out a global online scam and malware infestation," Paul Roberts wrote on Threatpost.com. Six people were arrested in Estonia and charged with Internet fraud in the sting. A seventh, who was living in Russia, remains at large.

Once the faulty DNS servers were discovered, a non-profit called the Internet Systems Consortium replaced the servers with the help of a court order. Paul Vixie, founder of the ISC, estimated that 500,000 devices were still connecting to the temporary servers. When the court order expires on July 9th, those temporary servers will be shut down, leaving hundreds of thousands without Internet, unable to have their webpage requests translated by a DNS server.