Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites with their own ads. My question is that how the nameservers did it? Did they work as some kind of proxy which intercepted the flow of data, something like ettercap filters? Any links for more study would be appreciated. Thanks.

share|improve this question
up vote 2 down vote accepted

The DNSChanger trojan had all the sophistication right in the name: it would simply change the DNS server entries on the victims' computers to point to their own rogue DNS servers.

The rogue DNS servers were probably a regular BIND installation providing recursive lookups that was authoritative for zones they found interesting: other advertisers, anti-virus update sites, etc.

share|improve this answer
Hmm.. I didn't think of that. Thanks for the answer. – Wise Sep 16 '12 at 18:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.