Google to alert thousands over loss of internet risk from DNSChanger Trojan

Google is to embark on an awareness-raising programme that will see it notify roughly half a million users that they may be on the brink of losing their internet connection as a result of a malware infection.

Google will alert users via its search results page if it believes they are infected with the so-called DNSChanger Trojan.

“Our goal with this notification is to raise awareness of DNSChanger among affected users,” wrote Damian Menscher, a security engineer at Google on a company blog.

“We believe directly messaging affected users on a trusted site and in their preferred language will produce the best possible results.”

The DNSChanger Trojan was capable of hijacking people's computers and altering its domain name system (DNS) settings. That allowed its authors to redirect users when browsing the internet, pointing them to fake sites.

The Federal Bureau of Investigation (FBI) and Estonian authorities were able to take over the servers originally run by Trojan's perpetrators, redirecting infected users back to their intended destination.

But those servers are set to be turned off imminently – the court order keeping the servers whirring runs out on 9 July. When that happens, users whose machines are still infected will lose their ability to surf the web.  

Industry groups have been working relentlessly to warn infected users about the risks.

But according to Menscher, a significant number remain infected and have proved hard to reach with previous education campaigns.

"Many of these campaigns have had limited success because they could not target the affected users, or did not appear in the user’s preferred language," he said.

Below: Example of the warning notification that will appear to users on Google.