I know DNS changer, changes DNS server with its own Evil DNS server on an infected computer, then the DNS servers point to their own rogue nameservers and the nameservers change the ads on websites with their own ads. My question is that how the nameservers did it? Did they work as some kind of proxy which intercepted the flow of data, something like ettercap filters? Any links for more study would be appreciated. Thanks.

1 Answer 1


The DNSChanger trojan had all the sophistication right in the name: it would simply change the DNS server entries on the victims' computers to point to their own rogue DNS servers.

The rogue DNS servers were probably a regular BIND installation providing recursive lookups that was authoritative for zones they found interesting: other advertisers, anti-virus update sites, etc.

  • Hmm.. I didn't think of that. Thanks for the answer.
    – Wise
    Commented Sep 16, 2012 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .