DNSChanger malware Check-Up

Update 9th May 2012
Cloudflare now has an app which can automatically warn your site visiters of a problem with their dns .
https://www.cloudflare.com/apps/dnschanger_detector

https://forms.fbi.gov/check-to-see-if-your-computer-is-using-rogue-DNS

DNS Changer most often comes disguised as a video “codec” supposedly needed to view adult movies. It infects systems at the boot sector level, hooking into the host computer at a very low level and making it often very challenging to remove. This malware family didn’t just infect Microsoft Windows systems: Several versions of DNS changer would just as happily infect Mac systems as well. Other variants of the malware even hijacked DNS settings on wireless home routers. The FBI has posted several useful links to help users learn whether their systems are infected with DNS Changer.

Infected PCs may lose Internet in July

http://www.usatoday.com/tech/news/story/2012-04-20/internet-woes-infected-pcs/54446044/1

Feike Hacquebord, senior threat researcher for security vendor Trend Micro, called the arrest the “biggest cybercriminal takedown in history.” In a blog post



The following links relate to this entry:

• Making a Million, Part One—Criminal Gangs, the Rogue Traffic Broker, and Stolen Clicks
• Making a Million, Part Two—The Scale of the Threat
• A Cybercrime Hub

For more information, Rik Ferguson posted an entry on his CounterMeasures blog on ways to check if you’re a victim of the “Operation Ghost Click” criminal activity.


http://www.dns-ok.us

or

http://www.dns-ok.de/

or

http://www.dns-ok.gov.au

FBI help links

• Learn about DNSChanger malware and how it can affect your computer
• Check your computer’s DNS settings
• Register as a victim of the DNSChanger malware

You can also test to see if you are affected by visiting the following DNSChanger Check-Up sites below. If this Check-Up site indicates that you are affected by DNSChanger, then visit http://www.dcwg.org/cleanup.html for information on how to address this problem.

Manhattan U.S. Attorney Charges Seven Individuals for Engineering Sophisticated Internet Fraud Scheme That Infected Millions of Computers Worldwide and Manipulated Internet Advertising Business
Malware Secretly Re-Routed More Than 4 Million Computers, Generating at Least $14 Million in Fraudulent Advertising Fees for the Defendants

http://www.fbi.gov/newyork/press-releases/2011/manhattan-u.s.-attorney-charges-seven-individuals-for-engineering-sophisticated-internet-fraud-scheme-that-infected-millions-of-computers-worldwide-and-manipulated-internet-advertising-business

http://krebsonsecurity.com/tag/vladimir-tsastsin/

‘Biggest Cybercriminal Takedown in History’

http://krebsonsecurity.com/2011/11/malware-click-fraud-kingpins-arrested-in-estonia/

URL	Language	Maintainer
http://www.dns-ok.us/	English	DNS Changer Working Group (DCWG)
http://www.dns-ok.de/	German	Bundeskriminalamt (BKA) Bundesamt für Sicherheit in der Informationstechnik (BSI)
http://www.dns-ok.fi/	Finish	CERT-Fi
http://www.dns-ok.ax/	Swedish	CERT-Fi
http://www.dns-ok.be/	Dutch/French	CERT.be
http://www.dns-ok.fr/	French	CERT-LEXSI
http://www.dns-ok.ca/	English/French	CIRA and CCIRC
http://www.dns-ok.lu/	English	CIRCL
http://dns-ok.nl/	Dutch/English