Possible loss of your internet in July?

[treitz3]

I spotted this on another forum and I thought I might mention it here. I have no idea about the legitimacy of this, as I am not a computer guru. I ran a scan on my computer and it looks right now as if I'm clean and will not be affected.

The DNS changer malware group that was busted last Nov. infected a lot of computers. The FBI has been running a server to intercept infected machines but this will end in July. If your computer is infected, you will not be able to get on the internet according to reports. You'll just get a page not found error.

You can go here to get a quick check: http://www.dcwg.org/detect/

Here's some background on the issue. This has been in the news reports in the last few days. http://www.dcwg.org/

As always, keep your protection up to date.

 

[Steve williams]

I'm good too

 

[FrantzM]

Have you checked your router.. The malware in some situations is capable of changing DNS settings wihin the routers themselves especially if you have left the router with the default password and login .... Routers that can be affected are the more popular ones such as Linksys, D-Link, Netgear ...etc ... I have heard of a few cases where it checks green but the router itself was corrupted.. New Communications ways We had Pirates (have still) of the seas, bandits of the roads, now Internet bandits ... it never ends ...

 

[MylesBAstor]

Am I the only one suspicious of this post? How do you know that you aren't doing the exact opposite of what you intend by running this program?

 

[FrantzM]

This is backed up by the FBI.. If you need more info go THERE

 

[treitz3]

Reading about how the FBI was involved lead me to believe that this was for real, hence the post about this. FrantzM, how would one check to see if the router itself has been infected and do you know if it can be removed or will the router have to be replaced?

 

[FrantzM]

Assuming a router like the limksys. You would need to go inside the router configuration GUI.. DO not run the automatic config or the Wizard. You must manually check the router DNS settings... It can get involved but patience wil help. You should look if SNS is set to DHCP or manual. If it is DHCP , likely your ISP is sending the correct information to your router. If however the DNS is set to manual, check the list of DNS servers entries this one (could be incomplete)
77.67.83.1 77.67.83.254
85.255.112.1 85.255.127.254
67.210.0.1 67.210.15.254
93.188.160.1 93.188.167.254
213.109.64.1 213.109.79.254
64.28.176.1 64.28.191.254

The FBI has appropriated these numbers but I believe they were to release them on March 10 (?)2012, the date might have changed but one ting is sure they will be released.

If your DNS settings shows any of these IP addresses your router is corrupted. No need to panic though. If you're brave simply set your DNS settings to DHCP, not that safe they may have corrupted your router in more ways.. Better, reset the router to factory defaults.. Hard reset.. press the reset button for 30 sec then release.. Unplug router for at least a minute .. Press again the same reset button and hold it for at least 15 secs.. Then release. The router will reboot and in most cases return to manufacturer defaults.
You then run the config and please this time enter a new password and user login.. Don't use the defaults .. that was the malefactors entry point .. Close that door.

As a rule Don't ever use in anything that will face the Internet default passwords and login.. Write the password to the bottom of the device if you tend to forget (as i do) passwords .. In many routers disable if you can access to the router from the Internet. Usually WAN access or remote configuration or something to the effect of accessing the router from the Internet. it is one feature most home users aren't likely to use.

 

[treitz3]

Thank you for taking the time to answer that, Frantz. Much appreciated.

 

[NorthStar]

In July I'm goin' fishin'. :b