In November 2011, Operation Ghost Click led  to the arrest of six men in Estonia for allegedly using the DNSChanger Trojan to acquire sensitive information from Fortune 500 companies.  An estimated four million computers were infected by the said malware, of which 100,000 are suspected to be found in the US.  A federal judge approved a plan for the Internet Systems Consortium, the non-profit group that maintains the popular BIND DNS open-source software, to deploy substitute DNS servers.

As part of Operation Ghost Click, the FBI seized more than 100 servers hosted at U.S. data centers and called upon Paul Vixie, founder of the ISC, To replace those servers–and allow infected computers to use the Internet.  Vixie and his company has been operating the servers since November of last year.  The problem is, U.S. District Court Judge William Pauley had said the ISC must pull the plug on the stand-in servers on March 8.

Don’t fret, the FBI is asking the court to extend the deadline until July 9th as consumers, enterprises, and Internet Service Providers (ISPs) need the extra time to scrub off the malware from their systems and restore valid DNS settings.

“Extending the operation of the Replacement DNS Servers will provide additional time for victims to remove the malware from their computers, thereby enabling them to reach websites without relying on the Replacement DNS Servers,” the government’s request stated.

“In a communication dated January 27, 2012, a representative of one ISP estimated that approximately 50,000 of its customers are infected with the malware.  According to [that] ISP, absent continued operation of the Replacement DNS Servers, its customers are at risk of being unable to access the Internet,” the statement added.

The FBI also needs the extra time to inform victims in foreign countries.

Users who suspect that their computers are infected with the DNS Changer Torjan can follow the detection and disinfection steps posted on the DNS Changer Working Group’s website.