Watch on Demand



Defunct virus knocks computers off web

Defunct virus knocks computers off web

Tens of thousands of people may have lost their Internet connections early Monday.


The problem behind the disconnect is a now-defunct computer virus called DNSchanger.

The virus infected computers and then rerouted them through servers controlled by hackers.

"Criminals have learned that if they can control a user’s DNS servers, they can control what sites the user connects to on the Internet. By controlling DNS, a criminal can get an unsuspecting user to connect to a fraudulent website or to interfere with that user’s online web browsing," the FBI said in a statement describing how the hack worked.

The good news is that the FBI broke up the virus ring and took control of the infected servers in Nov. 2011.

While the threat was eliminated, many infected machines were still accessing the Internet through the servers.


Keep in mind, if you do not have DNS service, you do not have Internet service.

While the FBI has helped maintain and run clean servers to assist victims, it won't do so forever. On July 9, those servers will be shut down. 

Click the "next page" button below for help determining whether your computer is infected, and if so, what you should do to get rid of the virus.

Anyone with an infected machine will have between now and July 9 to get rid of the virus. If not, they will likely lose access to the Internet after the July 9 server shutdown.

For instructions on determining whether your computer is infected, and to learn how to remove the virus, visit this DNSChanger Working Group web page. Follow the instructions there. Please note, the page may be intermittently unavailable due to increased traffic.

You can also do a Google search. It doesn't matter what you search for, just type in a term and click search. If your computer is infected, the Google results page will show you a message saying your computer may be infected.