[LINK] itNews: '... DNSChanger shutdown'

[Scott Howard]

On Sun, Jul 8, 2012 at 5:14 PM, Roger Clarke <Roger.Clarke at xamax.com.au>wrote:

> At 9:54 +1000 9/7/12, Bernard Robertson-Dunn wrote:
> >Australian Government DNSChanger Diagnostic
> >http://www.dns-ok.gov.au/
>
> The explanations provided there and by the FBI generally seem pretty
> clear, and that's not easy to do.
>
> *BUT* I can see nothing that explains what tests the 'dns-ok' site applies.
>
> Is it invasive?
>

It's a completely static website that does nothing on your PC except
display a static page.

Or more correctly, one of two pages.

If your DNS request for www.dns-ok.gov.au comes from an IP address that is
known to be a DNS Changer server (and these addresses ARE well known), then
you will be directed to the website at 165.191.2.66 which is a static site
telling you that you ARE infected.

If the request comes from any other DNS server, then you will be sent to
165.191.2.65 which displays a page telling you that you are NOT infected.

If you'd rather not use a web browser, nslookup or ping will give you the
same result - if you get 66 you're "infected", if you get 65 you're not.

  Scott