Dns Changer Mac Os X El Capitan

Checking OSX (MAC) for DNS Changer Infections. The easiest way to check if your system is violated with DNS Changer malware is to go to one of the “are you infected sites.” www.dns-ok.us is one of the remaining active links. An archive of the original links is maintained below. Smart MAC Address Changer or Smart DNS Changer is a resourceful network utility for changing your DNS server and PC proxy settings along with the ability to change MAC address. The software gets installed quickly and easily with no interrupting adware. The tool was swift enough to start working in a matter of seconds.

These trojans start in the package install scripts.

Installation

Social engineering techniques are used to persuade the user into downloading and running this trojan. Websites hosting video (often illicit) claim that the video cannot be viewed without installing a new codec. The user is prompted to install the 'needed' codec.

The user then downloads:

Installing the fake codec:

Once the fake codec is installed, the video will play so as not to raise suspicion. During the installation, the local machine's DNS settings are adjusted to point towards a malicious server.

Changes the DNS Server

The trojan changes the OS X network settings to use a different DNS server. DNS Settings are made with a tool called scutil.

The DNS Server Addresses vary. For example, Trojan:OSX/DNSChanger.A directs traffic to servers located in Ukraine.

Reports Back

After installation, the script sends back an HTTP message with information that it successfully infected the system. The message contains the operating system version and the host name.

Prevents Disinfection

The install script adds a crontab (a configuration file that specifies shell commands to run periodically on a given schedule) to a script to verify the malicious DNS servers remain unchanged. The script is stored in /Library/Internet Plug-Ins and is named plugins.settings.

Dns Changer Mac Os X El Capitan

The trojan infects both 10.4 and 10.5 versions of Mac OS X.