Hi all..I have a question about mcafee anti-virus...will current dat's trigger a virus alert for the dns changer bot? Just wondering as I need to check 600 pc's and if it does trigger an alert that would help me immensely. Thanks.
Yes, known variants will be detected by the DATs. Here's a (slightly paraphrased) comment from the McAfee Labs Product Manager:
"Detection for known DNS changer variants have been in thedats for months. The special Stinger is needed in cases where the malware has been removed but the rogue DNS entries remain on the system. One can use the special Stinger, or go to www.mcafee.com/dnscheck - a site that was setup to scan and repair machines with rogue DNS entries."
Looks like the signature has been in the DAT (since (6170) for a while now
I would have thought a full system scan would pick it up.