I'm not aware of any tools, and I'm not sure how effective they would be. If you got enough privileges to change the DNS servers of a system, you can probably also disable any anti-malware programs.
If you still want to, you could easily write a script that does the following:
- Query for the domain you want to be sure is correct, using the system's DNS servers
- Query a trusted DNS server for the same domain
- Query a second trusted DNS server for the same domain
From which you can conclude:
- If they all give the same IP, it's probably legit.
- If the trusted DNS servers give the same IP but yours doesn't, something is wrong
- If they all give different IPs, the nameserver of the target domain uses round-robin or split horizon
This is, like with almost everything, not entirely safe. Like I said, malware needs a lot of privileges to do this, it's not unthinkable that it spoofs the IP for trusted servers like OpenDNS or Google's public DNS, making them appear to return the same answer as the malware server.
Probably the only way to ensure you are talking to trusted DNS servers, is by using DNSSEC.