Wikipedia
DNSChanger was a DNS hijacking Trojan active from 2007 to 2012. The work of an Estonian company known as Rove Digital, the malware infected computers by modifying a computer's DNS entries to point toward its own rogue name servers, which then injected its own advertising into Web pages. At its peak, DNSChanger was estimated to have infected over 4 million computers, bringing in at least US$14 million in profits to its operator from fraudulent advertising revenue.
Both Windows and Mac OS X variants of DNSChanger were circulated, the latter taking the form of a related Trojan known as RSPlug
The FBI raided the malicious servers on November 8, 2011. but they kept the servers up after they captured it to avoid affected users from losing internet access until July 9, 2012.