Virus could black out nearly 250,000 PCs

BOSTON Thu Jul 5, 2012 6:23pm EDT

Related Topics

BOSTON (Reuters) - About a quarter-million computer users around the world are at risk of losing Internet access on Monday because of malicious software at the heart of a hacking scam that U.S. authorities shut down last November.

Some blogs and news reports hyped the risk of an outage, warning of a potential "blackout" and describing the Alureon malware as the "Internet Doomsday" virus.

Yet experts said only a tiny fraction of computer users were at risk, and Internet providers would be on call to quickly restore service. They said they considered the threat to be small compared with more-prevalent viruses such as Zeus and SpyEye, which infect millions of PCs and are used to commit financial fraud.

As of this week, about 245,000 computers worldwide were still infected by Alureon and its brethren, according to security firm Deteque. That included 45,355 computers in the United States.

The viruses were designed to redirect Internet traffic through rogue DNS servers controlled by criminals, according to the FBI. DNS servers are computer switchboards that direct Web traffic.

When authorities took down the rogue servers, a federal judge in New York ordered that temporary servers be kept in place while the victims' machines were repaired. The temporary servers will shut down at 12:01 a.m. EDT (0401 GMT) on Monday, which means the infected PCs that have not been fixed will no longer be able to connect to the Internet.

Some U.S. Internet providers, including AT&T Inc and Time Warner Cable, have made temporary arrangements so that their customers will be able to access the Internet using the address of the rogue DNS servers.

Information on how to identify and clean up infections can be found on a website that a group of security firms and other experts set up: www.dcwg.org.

"It's a very easy one to fix," said Gunter Ollmann, vice president of research for security company Damballa. "There are plenty of tools available."

Many of the machines that remain infected are probably not in active use since most victims were notified of the problem, said security expert Johannes Ullrich, who runs the Internet Storm Center, which monitors Web threats.

The United States has charged seven people for orchestrating the worldwide Internet fraud. Six were arrested in Estonia, while the seventh, who was living in Russia, is still at large. Tallinn has so far extradited two of the men to New York where they appeared in Manhattan federal court.

The case is USA v. Tsastsin et al, U.S. District Court for the Southern District of New York, No. 11-cr-878.

(Reporting by Jim Finkle in Boston; Additional reporting by Basil Katz in New York; Editing by Lisa Von Ahn)

FILED UNDER:
We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
Comments (4)
JBaustian wrote:
The headline is misleading, since these computers are not infected with a virus. Viruses are only one kind of malware. And it is the FBI shutting down the servers that will result in these computers being unable to connect to the Internet.

Jul 05, 2012 11:58pm EDT  --  Report as abuse
33factcheck wrote:
Why was the FBI running these servers? To attempt to trace the malware back to its origin? To keep infected users operating? Pure nonsense! This is just a press release to attempt to justify more funding for an agency that is already over funded and has done nothing to end the malware problem.

Jul 06, 2012 11:02am EDT  --  Report as abuse
So the FBI wants us all to log onto their website so that they can scan our computers and install their software…

Does that sound fishy to you too?

Jul 06, 2012 11:34am EDT  --  Report as abuse
This discussion is now closed. We welcome comments on our articles for a limited period after their publication.