DNSChanger check tool: Malware infection could cause internet loss Monday, FBI responds

NEW YORK (CNNMoney) -- Hundreds of thousands of Internet users whose computers are infected with a particularly nasty virus will be unable to access the Web starting on Monday.

The Federal Bureau of Investigation will shut down Internet servers that it temporarily set up to support those affected by malicious software, called DNSChanger. Turning off those servers will knock all those still infected offline.

Over the past five years, a group of six Estonian cybercriminals infected about 4 million computers around the world with DNSChanger. The malware redirected infected users' Web searches to spoofed sites with malicious advertisements.

In November 2011, the FBI and some overseas partners arrested those responsible, commandeered their servers, and attempted to warn those affected to get rid of the virus.

The FBI did not immediately take down the rogue servers, as infected computers would have lost Internet access, an FBI spokesman said.

To remedy the problem, the FBI had the nonprofit Internet Systems Consortium set up temporary servers. That way, computer owners would have time to get rid of their malware.

The servers were supposed to be shut down in March, but hundreds of thousands remained infected. Nearly 304,000 computers worldwide (about 70,000 in the United States) still had the virus in mid-June, according to the FBI's latest report.

The FBI decided to give people even more time to check for the malware, extending the deadline until July. The agency now says the time has come to cut the cord, and the emergency servers will be shut down on Monday.

Though the FBI tried to send notifications to those infected, it could not identify all of them, a spokesman said.

To help the users still infected, the agency laid out a step-by-step plan on how to check to see if your computer has the virus. (FOR HELP GUIDE SEE BELOW).

How did this all happen?

The servers the cybercriminals set up redirected search traffic to their own rogue servers, bypassing Google, Microsoft's Bing or other search engines' servers. Users would be shown fake search results that sent them to spoofed websites with manipulated online ads.

For example, when a user searched for Netflix and clicked on the fake search result, he or she would instead be redirected to an unrelated website called "BudgetMatch." If a user searched for ESPN and clicked through, DNSChanger would replace Dr. Pepper 10 ads on ESPN's website with an ad for a timeshare business.

The fraudsters made $14 million through those illegal ads, the FBI said.

The malware also prevented users from updating their operating systems or anti-virus software, which may have detected the virus.

Facebook and Google joined the awareness efforts by alerting users whose devices appear to be infected. Both sites display warnings and provide links to help get rid of the malware.

HELP GUIDE:

Overall help guide: http://www.dcwg.org/detect/

The FBI has also set up a link to help: http://www.fbi.gov/news/stories/2011/november/malware_110911/

Click this to see if your computer is infected: http://www.dns-ok.us/   -- If you see a "green" screen, your computer is OK. But if you see a "red" screen, your computer is infected.

If your computer is infected, click here to learn how to get rid of the infection: http://www.dcwg.org/fix

The following sites can also help you with free or low-cost products to check and fix your computer if it's infected:

·         Microsoft Safety Scanner - http://www.microsoft.com/security/scanner/en-us/default.aspx

·         Kaspersky Labs TDSSKiller - http://support.kaspersky.com/faq/?qid=208283363

·         McAfee Stinger - http://www.mcafee.com/us/downloads/free-tools/stinger.aspx

·         Hitman Pro (32bit & 64bit versions) - http://www.surfright.nl/en/products/

·         Norton Power Eraser - http://security.symantec.com/nbrt/npe.aspx

·         Trend Micro Housecall - http://housecall.trendmicro.com

·         MacScan - http://macscan.securemac.com/

·         Avira - http://www.avira.com/en/support-for-home-knowledgebase-detail/kbid/1199

For more information for Windows users: Microsoft Safety & Security Center - http://www.microsoft.com/security/default.aspx

For more information

for Apple users: Apple Product Security - https://ssl.apple.com/support/security/