I want to verify that router was not affected by DNS changer virus. Router provided by local Internet provider, runs custom firmware with web admin which does not contain DNS settings, no telnet/ssh/upnp. Is it possible to verify that it does not configured to use malicious DNS servers? Is it possible to do that just by performing some analysis with DNS queries from inside local network?
DNSChanger works be forcing you to use a DNS server managed by a malicious party, which thus can reply to your DNS queries with the wrong answers containing IP addresses in the control of the attacker. This way your systems connects to a different (and attacker controlled) system than you've intended and allows the attacker to hijack and man-in-the-middle your traffic.
To find out if your router is infected you thus need to find out what DNS server the router is using and compare it to your expectations. If you don't have access to the routers configuration you can use the help of some external service, which lets you visit a unique domain in control of the service and then shows you from where the DNS query for this domain came. If your router is not infected by DNSChanger then the source of the DNS query should be likely the DNS server of your ISP.
An external site which provides such service is Router Checker service offered by F-Secure. It shows you from where the DNS request came and if the DNS server in questions looks suspicious.
Note that this shows you the DNS server used by your browser. While this is the the DNS server provided by your router in most cases it does not need to be. For example your browser might be using DNS over HTTPS and thus is ignoring the setting provided by your router. Or you might have configured your system to use a different DNS server then the one provided by the router. This might have been done by manually, by using some privacy enhancing software or also by malware. In these cases this method will not show you if your router is infected since it does not use the DNS server offered by the router. But it shows you at least if connections done by your browser would have been hijacked, no matter if done by your router or somewhere else.