DGA.Changer

DGA.Changer, not to be confused with the unrelated PC threat DNS Changer, is a Trojan downloader that recently was distributed in drive-by-download attacks using hacked website servers. DGA.Changer's name is based on its fairly advanced means of acquiring domain names for its servers, with a dynamic feature set that's meant to prevent DGA.Changer from being detected or blocked by standard security protocols. Although malware researchers haven't observed any major attacks initiated through DGA.Changer's downloading functions thus far, its campaign appears just to be beginning, and removing DGA.Changer through strong anti-malware strategies is critical to keeping your PC safe.

A Change in Trojan Problems to Cap Off the Old Year

DGA.Changer is a Trojan that only recently is starting to be examined in-depth by the PC security industry, although attacks distributing DGA.Changer have received significant notice since October of 2013. A dedicated Trojan downloader whose sole apparent purpose is to install other threats), DGA.Changer's payloads, to date, have had little of interest. However, some unique details about DGA.Changer's defense mechanisms warrant special warning from malware researchers.

DGA.Changer's name is based on its method of 'changing' its DGA, or Domain Generation Algorithm. Whereas some Trojans coded by unmotivated criminals use hard-coded servers that can't be changed without making significant modifications to the program, DGA.Changer is designed to switch servers and even domain name seeds, with the latter determining which list of servers will be chosen. This can work around some analysis methods in use by most PC security companies, due to the differences between the domains used before and after the switch.

In practical terms to casual PC users, the above defenses have little meaning except insofar as they prevent security products from detecting or blocking DGA.Changer. However, DGA.Changer's other functions clearly are meant to install additional unsafe software onto the compromised PC. Thus far, DGA.Changer only has been confirmed to install non-functional files that most likely are part of the testing apparatus for future campaigns. Malware experts often see these types of attacks used as the initial phase in the distribution of Trojans that steal bank account information or create backdoor vulnerabilities, allowing criminals to have high-level access to the system.

Changing Your PC Back to One without DGA.Changer Difficulties

DGA.Changer is installed without any symptoms and doesn't show symptoms during the course of its functions, although future threats installed by DGA.Changer may not follow these general observations. Previous DGA.Changer-distributing attacks have used exploit kits that were inserted onto hacked Web servers, resulting in any casual traffic potentially being infected automatically. However, exploit kits can't finalize their attacks without exploiting software vulnerabilities, which malware experts note may, in most cases, be closed off by downloading relevant security patches. Disabling scripts also may block some components of these drive-by-downloads, which also will protect your PC from other threats besides DGA.Changer.

Since DGA.Changer isn't meant to grab the attention of its victims, expecting to be able to detect DGA.Changer by eye is a waste of time. As explained earlier, DGA.Changer does have some methods of evading basic security procedures. However, these features still should be inadequate against updated and competent anti-malware products, which should be able to delete DGA.Changer and anything that's been installed by DGA.Changer.