DNS threats identified following the transition to CloudFlare DNS settings.
DNS threats identified following the transition to CloudFlare DNS settings.
I chose to move from Googles DNS to CloudFlare after watching Linus's Floatplane video. Within ten minutes, my computer identified and blocked a Trojan. A scan with Malwarebytes revealed a bitcoin miner (though I hadn’t scanned recently). Just browsing YouTube—was it a coincidence?
Changing DNS providers from legitimate sources doesn’t automatically expose you to attacks unless the service itself is compromised. In such cases, they can only redirect you to a fake site, making it simpler to intercept requests (MITM) rather than taking control of the provider itself. Even then, attackers sometimes manage to remain undetected for a long time, especially if users aren’t vigilant. You’re likely encountering this through suspicious ads, unsafe websites, or unauthorized downloads.
Switching DNS providers doesn't grant access to download and install apps, whether they're safe or not. In the worst case, you might land on a fake site that mimics the real one but is infected. Even then, CloudFlare as a service would have had its security at risk, though this is rare. It usually happens when you click or download something. Unless everyone else uses the computer, it could be someone else who interacted with it.
At the time the alert appeared, it didn't specify a location for the Trojan or Bitcoin miner's origin. Windows7ge noted that changing DNS providers wouldn't impact this, suggesting it might just be random. It's possible the threat involved downloading a malicious file or clicking on ads/scripts that triggered the AV detection after signature updates. Likely, someone accessed a site with suspicious content and inadvertently triggered the malware.
I understand your point, but according to others, the most likely outcome would be being sent to fake sites, which seems improbable for YouTube. Are you the only one using this computer or do others have access?
It might help to scan other devices in your network to confirm no additional infected machines are involved. If you avoided a malicious site and Cloudflare redirected you to a suspicious page, the malware could be moving across your local network. The infection might have started on another system, which is a possibility. You may want to review the logs from Malwarebytes to identify the trojan and verify its details. It’s also possible the payload was scheduled, though this scenario is less likely. Do you remember the exact name of the malware? It should appear in your Malwarebytes logs. The lab’s detailed reports can clarify its behavior and spread method. Are you certain it wasn’t a false alarm?