The DNS Changer Working Group (DCWG) has been ordered to extend activities in providing clean DNS servers to replace malicious servers that were used to further infect machines with malware and fake software products.

The Internet runs on dotted decimal addresses, but human beings remember words easier than huge numbers.  So, the Domain Name Services tree was established to publish a translation from domain names to the dotted decimal addresses that computers understand.  For example, while you might type “www.johndscomputers.com” into the address bar of a browser, it is sent to a nameserver which will translate it into 216.239.131.9.

SecurityNewsDaily posted that a Brazilian Banking Trojan Poses as Microsoft Anti-Malware Tool.  This sounds particularly sneaky, as it momentarily replaces the boot loader long enough to infect the system and then sets it back in order to avoid detection.

It just proves that older methods of spoofing users into getting infected still work sometimes, and email even after all this time is only slightly safer than normal web surfing (perhaps even worse).

When cleaning a virus or other malware, one of the frustrating things about figuring out additional security measures is classifying the malware so you know what measures are needed.  For instance, you don’t necessarily want a customer to change all of their online passwords unless there is a very real threat (well, you may want to for other reasons, but there needs to be a balance in regards to how much you inconvenience a paying customer).

There are pretty good malware definitions, as well as how to clean them, on the Geeks To Go! forum “Malware Removal Guides and Tutorials” and the similar Bleepingcomputer.com forum somewhat misnamed as simply “Spyware Removal”.  However, these types of forums have the disadvantage of being staffed primarily by volunteers.  So, virus and malware definitions might not be as up to date as one would like.  Also, different vendors call malware by different names, which can be a real headache when trying to translate a name from what one vendor calls it to whatever the equivalent might be by a different vendor.  Sometimes, you’re better off just using Google if you know a virus name.

It is difficult to capture in short steps how to detect and remove computer infections of malware, but SecurityNewsDaily does a pretty decent job in “6 Signs Your Computer Has Been Infected … and 4 Ways to Fix It”.

One thing I cannot stress enough is to back everything up by booting from a CD (to minimize spreading the infection) by using something like the free Clonezilla or the more user friendly (but still reasonably priced) Acronis True Image Home.  Otherwise, you might end up in even worse shape because you cannot boot your computer.

However, I think that with the increasingly complex viruses and other trojans and malware out there, everything they list may not remove infections in a significant portion of cases.  That’s why a more comprehensive resource like Bleeping Computer’s Spyware Removal guide section is so important.

At the end of the day, however, many users would prefer to bring their computer to a professional, such as <ahem> John D’s Computer Services.  If you mention this blog article before 28 September 2011, you can get a malware cleaning for the old price of $75.00, which is only about 60% of the price of some of the brick and mortar guys!