Hundreds of thousands may lose web access July 9 due to virus

July 9 is the day thousands of PCs (and Macs) infected with DNSChanger will lose their ability to surf the web. Although the virus was introduced in 2007, according to the DCWG's data, as many as 500,000 computers may still be infected. This is a friendly reminder to make certain your computers are malware-free and that their DNS settings are nominal.

In 2011, the FBI busted the unscrupulous band of individuals responsible for DNSChanger, shutting down their Eastern European servers -- a move which actually knocked millions of infected users off the web. Although those servers run by the criminals were used to feed infected users profitable ads, phishing attempts and malware, they also provided victims with a working DNS service -- servers which allow human-friendly hostnames to point to Internet locations that computers understand (IP address numbers). 

Victims were left with computers configured to use DNS servers which no longer existed. As a result, nearly 4 million people were left without Internet access.

As a courtesy, FBI technorati organized an effort to temporarily provide DNS service for DNSChanger victims. After a period of time though, the FBI handed off this responsibility to the Internet Systems Consortium, a non-profit organization who has managed to keep the DNS flowing to infected users. However, this act of kindness will end on Monday.

How do I find out if I'm infected with DNSChanger?

Google and Facebook have been warning infected users. You can also manually check using this tool.

What should I do if I'm infected?

Visit DCWG for instructions and a list of utilities capable of removing DNSChanger from your computer. If none of these tools seem to work, your router's settings may have been changed by the virus (it does do that, believe it or not). You'll need to enter your router's web configuration (instructions vary) and change its DNS settings.

Virus scanners have been able to detect and prevent DNSChanger infections for some time now. Protect yourself!

Google discovers over 9,500 new malicious sites per day

On its security blog today, Google shared some of the numbers behind its anti-malware and anti-phising efforts. In the post, the company touts its Safe Browsing API which is used by the likes of Safari, Firefox and Chrome and offers some interesting details regarding the types of attacks unscrupulous individuals use against unsuspecting web surfers.

Over the years, says Google, the company has learned a great deal from having to protect its own servers, users, webmasters and Internet service providers. This expertise has aided Google during the past five years in its fight against Internet evildoers, a self-ascribed duty which has been (and continues to be) a mostly proactive effort.

Google says it finds an average of 9,500 new malicious sites every day. The company also delivers several million warnings on a daily basis through its Safe Browsing API, an anti-malware and anti-phishing service which Chrome, Safari and Firefox use to warn their 600 million collective users of harmful websites. In that same amount of time, Google also hands out about 12-14 million warnings to users trawling through its search engine. 

Through Google's partnership with StopBadware.org, the company also alerts thousands of webmasters every day regarding infected websites -- hackers frequently gain access to websites in order to insert malicious code into otherwise trustworthy websites and blogs.

Not surprisingly, the big G reports that malware and phishing attacks have grown in both numbers and sophistication. Malicious websites often have a short life -- less than an hour -- and periodically pop up under new, randomly generated domain names in order to avoid detection.

Even though the problem has grown and become a more international problem, web-based malware and phishing authors have also become better at targeting users with increasingly specific practices like spear phishing. 

Interestingly, the origins of most phishing scams can be traced back to hosts in the U.S. and Brazil. Iran, Spain, Australia and Peru are amongst least active countries when it comes to playing host or falling victim to phishing attempts.