DNSChanger Shut-Down Means Internet Blackout Coming For Hundreds of Thousands

Since you're reading this here, you're probably already aware that in the early hours of Monday, lots of DNS calls are going to fail as the FBI turns off servers from which Windows machines infected with DNSChanger have been served. New submitter SuperCharlie adds a reminder of the impending shutdown, and adds: "The FBI has a step-by-step method for you to see if you are infected in this PDF document, or you can go to dcwg.org for an automated check if you are so inclined."

Re:Why did this do it this way?

[Riceballsan]

IMO not informing them of what happened is. Believe it or not disconecting people, does not solve the problem, they buy a new computer take it to geek squad who nukes and paves it and sells them a rediculously overpriced unreliable antivirus. What could help would be to redirect the DNS servers to an informational page on how to clean off the current infection (IE hosting some cleanup tools), with tips of how to avoid infection again. No it won't educate 100% of them, some will take it to geeksquad anyway, some will find the download button and not read anything etc... but SOME will, and some is always better than none.

Why don't they...

[Annorax]

.. instead of shutting it down redirect all DNS requests to a page that says "Hey, butthead, your computer is infected. Fix it!"

Re:Why don't they...

[techno-vampire]

One of the easiest ways to infect computers is to put up a website with a phony virus scan and tell everybody that their system's infected, then offer to "clean" it for them. Most of us are trying to get our friends and family to understand that when a random website tells them that their computer's infected, it's a scam. What you're suggesting would just make our lives that much harder. Having all of their DNS fail, however, is going to make these people understand that there's something wrong, even if they don't have a clue about what's happening.

Re:Why did this do it this way?

[Jiro]

You don't want to redirect them to a page which tells them how to get rid of a virus. Believing pages that tell them that their system has malware and they need to follow the instructions on the page to get rid of it, is one of the common means of *spreading* malware.

Re:Why don't they...

[Malcolm Chan]

OK, so it'll probably work, then? These were the users who were willing to do it the first time, so why not a second time?

Re:Why did this do it this way?

[drinkypoo]

It's a massive win to me, because many of those people will probably sell their computer outright and buy another one, and then I can buy some of them (the nicer ones, anyway) at yard sales. A year or two ago (two I think) I got an Athlon 64 X2 4000+ system with a 20" LCD for $125 because the owner forgot the Admin password and couldn't figure out how to run recovery. The LCD also has S-Video, component and composite inputs and I'm using it for my PS2 right now...

Re:Security Awareness Fail

[wvmarle]

It teaches people that those unknown, never-heard-of-before, nondescript .org domains are fully safe and a-OK. Just pretend to be from the FBI, send them to such a site, and you can infect them all you want.

good riddance

[Tom]

Until malware seriously impacts those who are affected by it, interest by people to defend against it will remain minimal. Spammers thrive in this environment, because people don't care and can get away with it.

I am still for a forced disconnect of any spamming botnet member until he has cleaned up his machine. When you drive your car on a public road, you have responsibility for it being roadworthy. Same logic applies to computers on the Internet. If you don't connect it to anything, I don't care how many kinds of malware your machine contains. If you go online, and you don't have working headlights, so to speak, you need to be taken off the road.

I've had this argument inside ISPs. I am disgusted to this day by their cowardice. They fear customers would leave for competitors. Yeah, they probably would. That's why we need laws and regulations here, so everyone is in the same boat, at least within the same jurisdiction.

So I applaud this move, though I think it should've come much earlier.