FBI Limits DNSChanger Malware Damage; No 'Internet Doomsday'

The FBI shut down servers that allowed more than 4 million virus-infected computers to access Internet

July 9, 2012 RSS Feed Print

After months of warnings, the FBI cut off the safety net that allowed as many as 4 million virus-infected computers to continue to safely access the Internet over the past eight months. But, because of various outreach efforts, an "Internet Doomsday" that many predicted seems to have been overblown.

Last year, the FBI uncovered and disabled computer malware that was unscrupulously leading millions of Internet users worldwide to fraudulent websites. After discovering the malware, called DNSChanger, the agency took over the servers, which the agency says were likely operated by Russian criminals. The FBI-run servers allowed infected computers to continue accessing the Internet normally—but Monday, in a scheduled shutdown, those servers, which were costly to operate, were taken offline.

[Hackers Wanted: Companies Facing a Shortage of Offensive-Minded Cyberwarriors]

The malware operated by changing a computer's Internet settings to force it to access rogue, criminally-operated servers, which the FBI said were being used to direct users to fraudulent websites, where criminals could harvest sensitive personal information. After discovering and seizing the servers, the FBI cleaned them up and operated them as normal servers, for several months until a majority of those infected could remove the malware, allowing millions of users to stay online.

Because users' Internet experiences remained essentially unchanged throughout the process and personal files were left unharmed, experts called Monday "Internet Doomsday" because it'd be easy for average users to not know they were infected. But widespread outreach campaigns by the FBI, Google, and Facebook informing users how to clean up the malware seem to have minimized the damage: FBI spokesperson Jenny Shearer told ABCNews that about 300,000 computers worldwide and about 46,000 in the United States remained infected, a fraction of those originally affected.

[World Powers Play the Blame Game With Flame Virus]

The malware can be easily cleaned by new antivirus updates, and the FBI has published a guide to removing it, but experts are advising anyone whose computer remains infected and can't manually remove the virus to contact their Internet service providers if they've lost access.

Jason Koebler is a science and technology reporter for U.S. News & World Report. You can follow him on Twitter or reach him at jkoebler@usnews.com