Impact of terminating the DNS server of DNSChanger

Recently, the Information Security News reported that the U.S. Federal Bureau of Investigation (FBI) would shut down those domain name servers (DNS - ^{Note 1}) associated with the DNSChanger Botnet on March 8. What is the impact of this incident to the Internet users? Hong Kong Computer Emergency Response Team Coordination Center (HKCERT) would like to give some the background information of DNSChanger, method to detect infection and solution for the affected users to handle it in time.

[Updated on Mar 7, 2012]

1. On March 5, 2012,  a US District Court (New York) signed a new order to extend the March 8 deadline to July 9^{(Ref. 5)}.
2. With the information provided by DCWG, HKCERT has informed the relevant ISPs the IP addresses of supected victims in HK. We expect the ISPs forwarding our advices and contact to the victims.

Background

The DNSChanger botnet malware has more than 2000 variants ^{(Ref. 1)}. It is estimated that there are over four million infected computers worldwide, affecting more than 100 countries. This botnet was allegedly operated by an IT company called “Rove Digital” in Estonia since 2007, until the mastermind of cybercrime ring was arrested in 2011 ^{(Ref. 2)}.

What is the Impact of DNSChanger infection?

DNSChanger malware primarily spreaded when a user accesses a particular website or downloads online video viewer software and get infected. The DNSChanger malware will secretly alter the DNS settings on the affected computer pointing to the DNS server established by cybercrime ring to completely control DNS to resolve the desired IP address. The cybercrime ring can use DNS Changer botnet to route the users to access specific web sites unknowingly, including replacing the advertisements on web sites that are loaded by users to generate click-fraud or implant other malicious software.

Why is it March 8?

In November 2011, in the "Operation Ghost Click" (Reference 3), FBI successfully shut down the DNSChanger Botnet. According to a court order, in order to avoid the infected computers to lost connection with Internet immediately, FBI was authorized to set up a number of temporary DNS server to maintain the DNS services for the victims to this issue within 120 days. This order would be expired on March 8, 2012. If FBI decide to close these temporary DNS servers as scheduled, several millions of the DNSChanger bots worldwide would not be able to connect to the Internet. To properly handle this problem, we must help the victims clean up the malware as soon as possible.

How to deal with the infected computer and broadband router?

Computer

1. Suggest to restore DNS setting of the infected computer to obtain it automatically. Please contact your ISP or IT administrators of your company to provide assistance.
2. Due to the computer infected with DNSChanger malware may prevent it to update the system and security software database, so the security protection is reduced and causes to infect with other malwares. You have to perform a complete malware scanning for your computer.
   

   1. Microsoft Windows

      You can use the free Malware Scanner (online edition) URL listed in HKCERT website to check and clean up your computer.

      https://www.hkcert.org/security-tools

       

   2. Apple Mac OS X

      You can install the following free malware scanner to check and clean up your computer.

      http://download.cnet.com/mac/antivirus-software/?filter=licenseName%3DFree

3. After clean up, use the above test method again to confirm domain name server settings is normal or not.