Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

tech4all

macrumors 68040
Original poster
Jun 13, 2004
3,399
489
NorCal
Read this story on Yahoo:

WASHINGTON (AP) — The warnings about the Internet problem have been splashed across Facebook and Google. Internet service providers have sent notices, and the FBI set up a special website.

But tens of thousands of Americans may still lose their Internet service Monday unless they do a quick check of their computers for malware that could have taken over their machines more than a year ago.

Despite repeated alerts, the number of computers that probably are infected is more than 277,000 worldwide, down from about 360,000 in April. Of those still infected, the FBI believes that about 64,000 are in the United States.
Users whose computers are still infected Monday will lose their ability to go online, and they will have to call their service providers for help deleting the malware and reconnecting to the Internet.

The problem began when international hackers ran an online advertising scam to take control of more than 570,000 infected computers around the world. When the FBI went in to take down the hackers late last year, agents realized that if they turned off the malicious servers being used to control the computers, all the victims would lose their Internet service.

In a highly unusual move, the FBI set up a safety net. They brought in a private company to install two clean Internet servers to take over for the malicious servers so that people would not suddenly lose their Internet.

But that temporary system will be shut down at 12:01 a.m. EDT Monday, July 9.

Most victims don't even know their computers have been infected, although the malicious software probably has slowed their Web surfing and disabled their antivirus software, making their machines more vulnerable to other problems.

But popular social networking sites and Internet providers have gotten more involved, reaching out to computer users to warn of the problem.

According to Tom Grasso, an FBI supervisory special agent, many Internet providers are ready for the problem and have plans to try to help their customers. Some, such as Comcast, already have reached out.

The company sent out notices and posted information on its website. Because the company can tell whether there is a problem with a customer's Internet server, Comcast sent an email, letter or Internet notice to customers whose computers appeared to be affected.

Grasso said other Internet providers may come up with technical solutions that they will put in place Monday that will either correct the problem or provide information to customers when they call to say their Internet isn't working. If the Internet providers correct the server problem, the Internet will work, but the malware will remain on victims' computers and could pose future problems.

In addition to individual computer owners, about 50 Fortune 500 companies are still infected, Grasso said.

Both Facebook and Google created their own warning messages that showed up if someone using either site appeared to have an infected computer.

Facebook users would get a message that says, "Your computer or network might be infected," along with a link that users can click for more information.

Google users got a similar message, displayed at the top of a Google search results page. It also provides information on correcting the problem.

To check whether a computer is infected, users can visit a website run by the group brought in by the FBI: http://www.dcwg.org .

The site includes links to respected commercial sites that will run a quick check on the computer, and it also lays out detailed instructions if users want to actually check the computer themselves.

Link: http://news.yahoo.com/malware-may-knock-thousands-off-internet-monday-063924510--finance.html

There isn't too much information on the article about the details of this malware; no name of malware, OS's affected, etc.
 

tech4all

macrumors 68040
Original poster
Jun 13, 2004
3,399
489
NorCal
Then God I'm not American. Disaster averted.

Actually, according the article, it's estimated there are 277,000 computers infected worldwide. 64,000 of those are in the U.S.

You should read a better article. The malware in question is W32/DNSChanger.trojan. Here is a better article :

http://www.pcmag.com/article2/0,2817,2403364,00.asp

There's a variant for OS X (yeah, OS X gets malware, this isn't a virus, blah blah) :

http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml

So you're not immune to this on a Mac.

Thanks for posting further information on this.
 

roadbloc

macrumors G3
Aug 24, 2009
8,784
215
UK
Oh. Didn't actually read the article. Just got up to 'But tens of thousands of Americans' and stopped.
 

neiltc13

macrumors 68040
May 27, 2006
3,128
28
Came in here wondering what "Internet Monday" is, and I still don't know :confused:
 

tech4all

macrumors 68040
Original poster
Jun 13, 2004
3,399
489
NorCal
Oh. Didn't actually read the article. Just got up to 'But tens of thousands of Americans' and stopped.

No worries :)

Came in here wondering what "Internet Monday" is, and I still don't know :confused:

hehe, yea that does sound a bit odd the way I wrote it.

What I meant was those who have this malware may loose their Internet connection on Monday.
 

mabel88

macrumors newbie
Sep 22, 2009
3
0
link to check for malware?

Hi
Would someone post a link to check if I have this malware ?
Rather get a link from here than on the interweb at large
Thanks
 

nec207

macrumors 6502
Mar 21, 2011
429
0
You should read a better article. The malware in question is W32/DNSChanger.trojan. Here is a better article :

http://www.pcmag.com/article2/0,2817,2403364,00.asp

There's a variant for OS X (yeah, OS X gets malware, this isn't a virus, blah blah) :

http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml

So you're not immune to this on a Mac.

It has been explain virus bypass authentication and Safari sanbox where trojan needs authentication and cannot bypass Safari sanbox.

There has been no malware that has bypass OS X authentication .
 

KnightWRX

macrumors Pentium
Jan 28, 2009
15,046
4
Quebec, Canada
It has been explain virus bypass authentication and Safari sanbox where trojan needs authentication and cannot bypass Safari sanbox.

There has been no malware that has bypass OS X authentication .

Whatever, you can still be infected with this trojan, as a variant exists and be without Internet monday. It would be quite ironic if your Mac was after the comment you just made.

And notice my comment already says everything you felt the need to reply to me, hence the "blah blah".

Always one.
 

Repo

macrumors 6502a
Feb 11, 2009
597
0
My guess is, tomorrow, if this all pans out, we'll see a bunch of "Hey! My internet isn't working!" facebook posts uploaded "via mobile." :p
 

nec207

macrumors 6502
Mar 21, 2011
429
0
Whatever, you can still be infected with this trojan, as a variant exists and be without Internet monday. It would be quite ironic if your Mac was after the comment you just made.

And notice my comment already says everything you felt the need to reply to me, hence the "blah blah".

Always one.

This topic what is trojan ,worm or virus has came up may time here.

Worms travel by e-mail address , URl and IP address where trojan and virus is application that must be run to work a virus copies and modifies files on your computer where trojan is file on your computer but does not make copies of it self.

Malware can be worm, trojan ,virus ,spyware, adware or keylogger so on. The end users does not care what it is at all but it is malware.

There has been malware where OS X but none has of yet bypass authentication. All been the end user typing in password to run,install or modify at system level.

Malware in user level cannot harm you mac only in system level . To cut down on malware infection never type your password when some thing wants to run,install or modify out of nowhere . And disable automatic downloading to your downloads folder.
 

KnightWRX

macrumors Pentium
Jan 28, 2009
15,046
4
Quebec, Canada
This topic what is trojan ,worm or virus has came up may time here.

Yes, and it's off topic for this thread. You've done enough in the other one to derail it without a careful understanding of how the different OSes work, don't do it here please.

Btw, something you should read about :

http://en.wikipedia.org/wiki/Privilege_escalation

OS X is not immune to this type of attack :

http://www.f-secure.com/vulnerabilities/SA30776

Making it quite possible to harm the system "areas" from a normal user account. Of course, you'd know this if you had one iota of an idea of how computer security actually works and what different attacks and attack vectors are out there.

Am I really going to have to go in circles with you for days ?
 

nec207

macrumors 6502
Mar 21, 2011
429
0
KnightWRX;15215447]Yes, and it's off topic for this thread. You've done enough in the other one to derail it without a careful understanding of how the different OSes work, don't do it here please.

You started it here.

You should read a better article. The malware in question is W32/DNSChanger.trojan. Here is a better article :

http://www.pcmag.com/article2/0,2817,2403364,00.asp

There's a variant for OS X (yeah, OS X gets malware, this isn't a virus, blah blah) :

http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml

So you're not immune to this on a Mac.


I was repying to that and here.


Whatever, you can still be infected with this trojan, as a variant exists and be without Internet monday. It would be quite ironic if your Mac was after the comment you just made.

And notice my comment already says everything you felt the need to reply to me, hence the "blah blah".

Always one.

I was just addressing worm, trojan ,virus that most people get hug up on in threads and use interchangeably that most of time leads to clarification here at macrumors.
 

KnightWRX

macrumors Pentium
Jan 28, 2009
15,046
4
Quebec, Canada
You started it here.

I was repying to that and here.

I was just addressing worm, trojan ,virus that most people get hug up on in threads and use interchangeably that most of time leads to clarification here at macrumors.

And that clarification was not needed here. My comment was made in order to prevent further clarification from occurring as it was not needed in this thread.

BTW, did you read up on privilege escalation bugs and how they crop up now and again in OS X ? Did you learn something new ? Tell us please.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.