This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but this taxpayer funded service will be discontinued July 9.
Sites like Google, and dns-ok.us have some way of knowing whether you are infected with the DNS Changer malware, so they can warn you, help you fix the problem so you don't lose internet when July 9 arrives.
Am I correct in assuming that they use the following model to detect this?
- The DNS servers the FBI replaced look up the IP address for an example domain. (such as dns-ok.us)
- The dns-ok DNS servers know whether or not this is one of those DNS Changeer / FBI replaced servers. If it is, it provides the IP address for infected visitors, otherwise it provides the one for clean visitors.
- Using the destination IP address of the incoming request, the web page is able to know whether to show the "you are infected" message.
This would require separate of one of the following for clean vs not clean
- Separate servers
- Separate network interfaces (physical or virtual, point is to hold separate IPs)
- A router with different port forwarding for each of the two (types of) IPs.
Or is there a more elegant solution they are using? Or is FBI cooperation involved?