The countdown begins (DNS Changer Malware)

 

Well tonight at 12 midnight EDT the FBI will disconnect the substitute server they put online. See:

http://www.poi-factory.com/node/36219

There are still about 45,600 U.S. users that are infected and about 250,000 worldwide.

If you haven't visited Google (they have automatic code to detect the malware when you go there) or visited http://www.dcwg.org (they have code as well), then after midnight you'll no longer have an internet connection - if you havn't removed the malware.

Once you have lost the internet, you'll have to get your service provider to walk you thru the removal process using the telephone.

Check with your friends and relatives and have them visit the sites listed above - just to be sure. Don't want to go thru POI Factory withdrawal do you?

BTW - some of the users with the malware are businesses!

--
Metricman DriveSmart 76 Williamsburg, VA
<<Page 2

.

David King wrote:

The website that detects if your computer is infected did so very quickly. If the malware is on your computer, how did it detect it without scanning your computer?

It must have be able to detect something about your connection that tells it you are infected?

I believe the site checks which DNS servers your computer is using. They have a list of rogue DNS IP addresses that the bad guys use (the FBI took control of these later on).

Say if your PC uses (rogue) DNS IP of 111.222.333.444 (don't laugh, I did it on purpose) for name resolution, the website knows it right away. Keep in mind that the site does not attempt to scan for malware and remove it. If you have it before the scan, you will still have it after.

If you have Windows, "ipconfig /all" (without quotes) will tell you the DNS server IP addresses your PC is using.

.

Double Tap wrote:

Just like all the computers were going to crash for the new millennium, NOT

Wanna know why no computers crashed when the century changed? Huh? Well, let me enlighten you and about a billion others that simply have no clue as to why that period of time passed with relatively no computer issues. About a million programmers and analysts, myself amongst them, worked for more than a year prior to that time to make sure literally billions and billions of lines of computer code would properly handle the century change.

When the first computer and code was invented, no one was able to foresee or even cared that their code would be around when the century changed. Storing the century in only two bytes instead of four saved two bytes every time a date was used. This was a concern way back when storage technology was primitive and massively expensive. The century field was only two characters in length, hence 1999 was represented in billions upon billions of lines of code as "99". So, as an example of the havoc that was avoided, imagine that you owe a bill as of 11/11/99 and it is now 12/31/99 and you haven't yet paid. How old is your debt? 50 days old. How old would your debt be on 01/01/00? You'd be responsible for one heck of a late charge.

Believe me when I tell you that if tens of thousands of people had not spent million of hours remediating computer code, the havoc would have been world-wide. The fact that "nothing happened" is a testament to the talent and skill of all those people.

And that is why the century changed with most people blissfully unaware of why "nothing happened".

Dynamic IPs

chewbacca wrote:
David King wrote:

The website that detects if your computer is infected did so very quickly. If the malware is on your computer, how did it detect it without scanning your computer?

It must have be able to detect something about your connection that tells it you are infected?

I believe the site checks which DNS servers your computer is using. They have a list of rogue DNS IP addresses that the bad guys use (the FBI took control of these later on).

Say if your PC uses (rogue) DNS IP of 111.222.333.444 (don't laugh, I did it on purpose) for name resolution, the website knows it right away. Keep in mind that the site does not attempt to scan for malware and remove it. If you have it before the scan, you will still have it after.

If you have Windows, "ipconfig /all" (without quotes) will tell you the DNS server IP addresses your PC is using.

Since I use Charter, they assign my DNS address when I log on. This means that Charter owns that IP.

So, if the FBI knew which IP's were infected, why could they not have alerted the owners of those IP's?

--
NUVI40 Kingsport TN

Good Explanation

scyntax wrote:

Wanna know why no computers crashed when the century changed?

...

Believe me when I tell you that if tens of thousands of people had not spent million of hours remediating computer code, the havoc would have been world-wide. The fact that "nothing happened" is a testament to the talent and skill of all those people.

And that is why the century changed with most people blissfully unaware of why "nothing happened".

I was always very proud of the IT people that I managed because their code stood the test of time even though the original databases did not (anyboby remember punch cards???). Adding function to the software usually involved adding (or, in the this year 2000 case, expanding) fields in the databases.

Yes.

I remember punch cards very well and went through the Y2K conversions in my organization ... and yes it was a big deal and a tribute to all the programmers and technicians who carried it off with no major disasters or disruptions. Changing the data bases and program logic to accommodate 4 digit year codes was one solution. Another common technique was to retain the 2 digit year codes in the data base and change the program logic to use a "sliding date window" tied to the current date. In many cases on older applications, the sliding date window approach required less programming and was just as effective of a solution. We used both techniques in my organization, depending on the nature of the application.

--
Alan - Android Auto, DriveLuxe 51LMT-S, DriveLuxe 50LMTHD, Nuvi 3597LMTHD, Oregon 550T, Nuvi 855, Nuvi 755T, Lowrance Endura Sierra, Bosch Nyon

Opted for 4 digit years

alandb wrote:

... Changing the data bases and program logic to accommodate 4 digit year codes was one solution.
...

We felt like the change to 4 digit years was the most complete approach.

.

David King wrote:
chewbacca wrote:
David King wrote:

The website that detects if your computer is infected did so very quickly. If the malware is on your computer, how did it detect it without scanning your computer?

It must have be able to detect something about your connection that tells it you are infected?

I believe the site checks which DNS servers your computer is using. They have a list of rogue DNS IP addresses that the bad guys use (the FBI took control of these later on).

Say if your PC uses (rogue) DNS IP of 111.222.333.444 (don't laugh, I did it on purpose) for name resolution, the website knows it right away. Keep in mind that the site does not attempt to scan for malware and remove it. If you have it before the scan, you will still have it after.

If you have Windows, "ipconfig /all" (without quotes) will tell you the DNS server IP addresses your PC is using.

Since I use Charter, they assign my DNS address when I log on. This means that Charter owns that IP.

So, if the FBI knew which IP's were infected, why could they not have alerted the owners of those IP's?

I believe the FBI replaced those rogue DNS with their own DNS to redirect infected computers to the correct destination. They just shutdown their operation this past weekend. Some infected computers loses internet connection because they can't resolve domain names to IP addresses.

Take a look at this www.fbi.gov/DNS-changer-malware.pdf

There's a list of IP addresses (rogue DNS servers) in the PDF.

.

scyntax wrote:

So, as an example of the havoc that was avoided, imagine that you owe a bill as of 11/11/99 and it is now 12/31/99 and you haven't yet paid. How old is your debt? 50 days old. How old would your debt be on 01/01/00? You'd be responsible for one heck of a late charge.

It's also possible that our debt gets wiped out completely. I was hoping for the latter bur darn it, your coders prevented that from happening.

.

I sure do remember punch cards and collators, and horror of horrors, printers that you had to hand program by creating paper tapes you ran through the little reader on the bottom of the printer. It was a good thing they were numbered. I can't tell you how many times I dropped a deck of about 200 on the floor...

College

scyntax wrote:

I sure do remember punch cards and collators, and horror of horrors, printers that you had to hand program by creating paper tapes you ran through the little reader on the bottom of the printer. It was a good thing they were numbered. I can't tell you how many times I dropped a deck of about 200 on the floor...

I first knew about the Hollerith punch cards during my first year in college. We used to have fun tripping the engineering students, making them drop the cards.

Later on I used them myself, and felt guilty for that.

--
NUVI40 Kingsport TN

Note taking

I finally ran out of the excess cards I brought home after we got rid of our keypunch machines and card readers. They were perfect for making notes on.

Sounds really easy to fix.

ipconfig /all on a PC would indicate if have a problem.

<<Page 2