July 05, 2012, 1:55 PM — Thousands of PCs worldwide may be unable to access the Internet beginning July 9 unless those machines are rid of the pernicious DNSChanger malware that first surfaced in 2007. The Federal Bureau of Investigation helped shut down the criminal ring responsible for DNSChanger in late 2011. The federal agency then briefly handled the Internet Domain Name System routing for all infected Mac and Windows systems.
Since early 2012, the Internet Systems Consortium, a nonprofit corporation, took over DNS routing responsibilities from the FBI. But that courtesy is coming to an end Monday, and if your computer is one of the thousands still infected, you need to fix your machine so you can keep getting online.
What did DNSChanger Do?
DNSChanger rerouted infected computers through servers controlled by a criminal ring based in Eastern Europe. The malware did this by taking advantage of the Internet's Domain Name System (DNS) service. Think of DNS servers like phone books for the Internet. These servers turn the plain text Web address that you enter into your browser, such as PCWorld.com, into a string of numbers. These numbers are known as Internet Protocol addresses (PCWorld's is 188.8.131.52) and computers use them to connect to one another and get around the Internet. IPs are assigned to home and business Internet connections and every website you visit.
It should be pretty clear that DNS is not something you want to have intercepted by criminals. Any time they want, criminals who control how your computer uses DNS can do malicious things such as reroute your computer to fraudulent websites. Once there, the sites can try to download more malware to your computer or attempt to harvest data such as login credentials.
DNS changing was only one of the malware's functions, according to the DNSChanger Working Group, a consortium of companies, universities and other institutions helping to deal with the impact of DNSChanger. The group says it's also possible DNSChanger could have also been capturing keystrokes (known as keylogging).
As of June 11, the group detected DNSChanger infections from more than 300,000 unique Internet Protocol Addresses worldwide. Nearly 70,000 of those unique IPs originated in the United States. An Internet Protocol address counts as one main connection to the Internet, but can include multiple PCs behind one IP.
How to Know if You're Infected