Security

Kira asked an interesting question:

How to know if your computer is hit by a dnschanger virus?

In case you didn’t hear, back in November, the FBI took down the company “Rove Digital” which was actually a set of cyber criminals, that created and distributed a DNS changing malware.  Here’s a little more detail straight from the FBI:

Criminals have learned that if they can control a user’s DNS servers, they can control what sites the user connects to on the Internet. By controlling DNS, a criminal can get an unsuspecting user to connect to a fraudulent website or to interfere with that user’s online web browsing. One way criminals do this is by infecting computers with a class of malicious software (malware) called DNSChanger. In this scenario, the criminal uses the malware to change the user’s DNS server settings to replace the ISP’s good DNS servers with bad DNS servers operated by the criminal.

HackToHell also gave a great explanation of what a DNS Changer virus does:

DNS (Domain Name System) is an Internet service that converts user-friendly domain names into the numerical Internet protocol (IP) addresses that computers use to talk to each other. For example, google.com is actually an IP address (173.194.38.164). DNS makes it easier for us to remember the site names. DNS servers convert the domain names into IP addresses. Now the malware, changes the domain naming servers in your computer and uses a different malicious DNS server. This malicious DNS server, swaps IP’s and takes the user to a fake site.

Unfortuantely his answer to checking if your computer is infected, is now obsolete.  So here’s and alternative:

more »