Earlier today SANS posted an excellent blog on a recent variant of a DNSChanger Trojan. There are some significant implications to this threat, but before I go into those, here’s a brief rundown of the main DNS-changing Trojan tactics used to date:
We’ve now seen a new tactic, which has the potential of impacting most devices on the local network–independent of the operating system or device (Windows, Linux, Internet-capable MP3 players, digital picture frames, refrigerators, you name it). The tactic involves serving the rogue DNS server configuration over DHCP, the protocol responsible for distributing dynamic IP addresses, as well as other information, including DNS settings.
Here’s a scenario:
The same applies to any local area network (LAN)Â where multiple system connect via DHCP.
This is significant for several reasons:
For those interested in the details, this DNSChanger variant drops the legitimate ArcNet NDIS Protocol Driver in the drivers directory:
The Trojan uses this driver to inject DHCP Offer packets containing the rogue DNS server IPs.

Variants using this functionality are not known to be widespread at this point, though even a single infected system could potentially impact hundreds of other systems on the LAN. Though it’s awkward to check, users could examine their DNS settings to see if they have been impacted. For example, type the following from a Windows command prompt:
ipconfig /all
For insight into some of what the DNSChanger gang is after, see this post.
I call it DNSChanger 2.0, it has changed the tactics now. Here is my writing about it and check out the protection/detection techniques checklist:
http://extremesecurity.blogspot.com/2008/12/dns-chanager-20.html
I’ve been infected with this variant, any solutions yet ?
How do i know if McAfee has a signature for the latest DNSChanger, discoverd on the 5th of December? The symantec name is Trojan.Flush.M but can’t find it under this name at McAfee…
All the more reason to consider using trusted third party DNS networks, such as OpenDNS.
https://www.opendns.com/smb/start
@Reporting a problem – still
Instead of complaining maybe you should notice all of the more common blog platforms do this out of the box and leave well enough alone. You are reading a security post, on a security blog, if you cannot figure out how to edit a bookmark title, then maybe you shouldn’t be in INFOSEC at all.
-nice to read, good for understanding the concept, but leaves with no hope for people with insufficient knowledge.
-i worked with a lot of people with mcafee on there comp.s and they have this problem while downloading mcafee or updating it.
-i would suggest you to equip the mcafee Security Center and the mcafee installer with a tool which can do the required step on its own.
Please fix your Website. When I bookmark a blog posting, the bookmark’s name is:
Computer Security Research – McAfee Avert Labs Blog
where it should be the title of that particular blog posting.
This is a long standing, and very annoying problem with your blog. Please fix it.
Thanks
Submit your own comments / message for this post