What Does DNSChanger Do to My Computer?
DNSChanger malware causes a computer to use rogue DNS servers in one of two ways.
First, it changes the computer’s DNS server settings to replace the ISP’s good DNS servers
with rogue DNS servers operated by the criminal. Second, it attempts to access devices on
the victim’s small office/home office (SOHO) network that run a dynamic host configuration
protocol (DHCP) server (eg. a router or home gateway). The malware attempts to access
these devices using common default usernames and passwords and, if successful, changes
the DNS servers these devices use from the ISP’s good DNS servers to rogue DNS servers
operated by the criminals. This is a change that may impact all computers on the SOHO
network, even if those computers are not infected with the malware.
