Zlob Trojan - RSPlug, DNSChanger, and Other Variants

RSPlug, DNSChanger, and Other Variants

The group that created Zlob has also created a Mac Trojan with similar behaviors (named RSPlug). Some variants of the Zlob family, like the so-called "DNSChanger", add rogue DNS name servers to the registry of Windows-based computers and attempt to hack into any detected router to change the DNS settings, potentially re-routing traffic from legitimate web sites to other suspicious web sites. DNSChanger in particular gained significant attention when the U.S. FBI announced it had shut down the source of the malware in late-November 2011. However, as there were millions of infected computers which would lose access to the internet if the malware group's servers were shutdown, the FBI opted to convert the servers into legitimate DNS servers. Due to cost concerns, however, these servers are set to shut down on the morning of July 9, 2012, which could cause thousands of still-infected computers to lose internet access.