A router under my control has been compromised, and the attacker has changed the router's primary DNS server to one that I haven't seen before, and it does not belong to any ISP's. I'm guessing this is a malicious DNS server.
Is there a way that I can easily check it for malicious records? At the moment I'm just going dig google.com @<ip of malicious DNS server>, but doing that for lots of websites one by one, and then comparing it to the results found on a known good DNS server is tedious.
You could try some common banking website domain names and see if the IP addresses of the actual sites are returned or if, instead, IP addresses not associated with the banks are returned. Also you could try other sites such as PayPal.com, where people could be tricked by a fake website into revealing a userid and password that could give the malefactor access to funds. Also, if you are in the U.S., the FBI may be interested in hearing from you - see Check to see if Your Computer is Using Rogue DNS:
The FBI is seeking information from individuals, corporate entities, and Internet Services Providers who believe that they have been victimized by malicious software (“malware”) related to the defendants. This malware modifies a computer’s Domain Name Service (DNS) settings and thereby directs the computers to receive potentially improper results from rogue DNS servers hosted by the defendants.
Put the DNS server's IP address in the field for "Check Your DNS" and have the FBI's site check the IP address. Even if the result is "Your IP is not configured to use the rogue DNS servers." that does not mean it is not a malicious DNS server, just that it isn't one of those the FBI is interested in for this case.
Can you provide the IP address of the rogue DNS server?
