Researchers from Georgia Tech studied the DNSChanger botnet’s remediation efforts. They found that phone contact, billing notices, and redirecting infected users to special Web pages are the best ways to alert them to their infections. Google’s direct notifications had positive impact even late in the process, the researchers found. The FBI set up its own stopgap DNS servers during the remediation process last year to prevent a major Internet blackout for the massive number of infected machines. “Active” social media updates also helped get bots cleaned up, such as Google’s directly informing users via their browsers.”]
Source: https://www.darkreading.com/attacks-breaches/how-best-to-break-the-news-to-users-that-they-re-a-bot