Date:         Fri, 6 Jul 2012 17:09:17 -0400
Reply-To:     David Beierl <dbeierl@ATTGLOBAL.NET>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         David Beierl <dbeierl@ATTGLOBAL.NET>
Subject:      Re: [WetWesties] Frydae DNS-changer attack update
Comments: To: wetwesties@yahoogroups.com
Content-Type: text/plain; charset="us-ascii"; format=flowed

At 04:11 PM 7/6/2012, Stuart MacMillan wrote:
>check and was okay, but it said "if your ISP is re-routing your inquiries
>you could still be infected even though you checked out okay" or some close
>to that.  Useless test IMHO.  I have to assume Comcast is ahead of this one!

I don't think ISPs in general reroute DNS inquiries.  In any case,
this is what epidemiologists call a screening vs a diagnostic
test.  A screening test can have false negatives, should not have
false positives, and should be cheap.  A diagnostic test can be
expensive and have false positives, but shouldn't have false negatives.

In other words, passing this test is not a guarantee you're
clean.  But it indicates a high probability that you are.  If you
*are* infected you're in a world of hurt involving potential stolen
data  and compromised passwords, outside ownership of your machine,
and tedious recovery procedures* - which will be a lot more difficult
if you don't have Internet access.

*see http://www.dcwg.org/fix/

So I disagree that it's useless.

Yours,
David