DNS Changer Working Group

   A screenshot of the DNSChanger scanning website, showing a clean bill of health. No software installation is required to run the scan, which can be found at dcwg.org. The warnings about the Internet problem have been splashed across Facebook and Google. Internet service providers have sent notices, and the FBI set up a special website. But tens of thousands of Americans may still lose their Internet service Monday unless they do a quick check of their computers for the DNSChanger malware that could have taken over their machines more than a year ago. Despite repeated alerts, the number of computers that probably are infected is more than 200,000 worldwide, down from over 300,000 in April. Of those still infected, the FBI believes that about 60,000 are in the United States. Users whose computers are still infected Monday will lose their ability to go online, and they will have to call their service providers for help deleting the malware and reconnecting to the Internet.

    The problem began when international hackers ran an online advertising scam to take control of more than 500,000 infected computers around the world. When the FBI went in to take down the hackers late last year, agents realized that if they turned off the malicious servers being used to control the computers, all the victims would lose their Internet service. In a highly unusual move, the FBI set up a safety net. They brought in a private company to install two clean Internet servers to take over for the malicious servers so that people would not suddenly lose their Internet But that temporary system will be shut down at 12:01 a.m. EDT Monday, July 9. Most victims don't even know their computers have been infected, although the malicious software probably has slowed their Web surfing and disabled their antivirus software, making their machines more vulnerable to other problems. But popular social networking sites and Internet providers have gotten more involved, reaching out to computer users to warn of the problem. Both Facebook and Google created their own warning messages that showed up if someone using either site appeared to have an infected computer. Facebook users would get a message that says, "Your computer or network might be infected," along with a link that users can click for more information. Google users got a similar message, displayed at the top of a Google search results page. It also provides information on correcting the problem.

To check whether a computer is infected, users can visit a website run by the group brought in by the FBI: http://www.dcwg.org.