Trojan:WinNT/Simda.gen!A

Posted: March 16, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	1,419

First Seen:	December 7, 2011
Last Seen:	October 30, 2023
OS(es) Affected:	Windows

Trojan:WinNT/Simda.gen!A is a rootkit that conceals its components in your system kernel to avoid detection and removal, while, in the meantime, causing browser redirects and creating a backdoor vulnerability that could be used to control your PC. Because backdoor-based attacks can steal personal information, install other PC threats or be responsible for many other forms of harm to your computer, SpywareRemove.com malware researchers recommend that you delete Trojan:WinNT/Simda.gen!A as soon you can access relevant anti-malware software. As a rootkit, Trojan:WinNT/Simda.gen!A also may require particularly discerning measures to be disabled and completely removed, and may persist even in Safe Mode. However, regardless of any symptoms or lack thereof that it may exhibit, Trojan:WinNT/Simda.gen!A should always be considered a high-level security threat that should be exterminated with haste.

Why Trojan:WinNT/Simda.gen!A is Just the Start of Your Problems

Trojan:WinNT/Simda.gen!A is a member of the Simda family, a group of Trojans and rootkits that focus on creating backdoor vulnerabilities on infected computers. Because Trojan:WinNT/Simda.gen!A and related PC threats often use multiple components and may inject their code into normal Windows processes, it's recommended that you use advanced anti-malware products to detect a Trojan:WinNT/Simda.gen!A infection. Manual detection, other than by observing symptoms of Trojan:WinNT/Simda.gen!A's attacks, may be very difficult or even impossible.

Trojan:WinNT/Simda.gen!A will launch itself with Windows and is unlikely to display any sort of visible program or memory process that's separate from your normal applications. However, despite its low key nature, SpywareRemove.com malware experts have determined that Trojan:WinNT/Simda.gen!A will make a considerable nuisance of itself with attacks such as:

Browser redirects that change your web browser's destination. Trojan:WinNT/Simda.gen!A may force you to load sites that promote PC threats, intercept personal information, redirect you to phishing sites or block PC security websites.
The creation of backdoor exploits. Backdoors are used by Trojan:WinNT/Simda.gen!A to communicate with a remote server, from which Trojan:WinNT/Simda.gen!A can receive other PC threats to download, as well as further instructions. Trojan:WinNT/Simda.gen!A may also send personal information to its server through this backdoor.

Uprooting This Rootkit Before It Trashes Your PC

Trojan:WinNT/Simda.gen!A may also be detected by other aliases, including the following popular designations: Trojan.Win32.Generic!BT, Trojan/win32.agent.gen, Trj/CI.A, Trojan.Simda.gen!A, WS.Reputation.1, UnclassifiedMalware and Win32 malware.gen. As its name implies, Trojan:WinNT/Simda.gen!A is designed at attack Windows NT-based computers, which includes Win 7, Windows XP, Windows Vista and Windows 2000. However, SpywareRemove.com malware researchers do note that non-Windows computers should be safe from a direct Trojan:WinNT/Simda.gen!A infection.

As a sophisticated rootkit with some backup-related functions, Trojan:WinNT/Simda.gen!A may require exceptionally stringent removal techniques before Trojan:WinNT/Simda.gen!A can be completely detected and deleted. SpywareRemove.com malware researchers recommend that you only use the most competent and up-to-date anti-malware applications for this task, and, if possible, encourage scanning your PC with your OS booted from an uninfected source (such as a USB drive).

Aliases

Artemis!F1202B91EAFC [McAfee]W32/SimdaM!tr [Fortinet]TR/Agent.265688 [AntiVir]Artemis!1DB2E1E5D82F [McAfee]Crypt.BAOV [AVG]TR/Crypt.XPACK.Gen [AntiVir]Mal/Generic-S [Sophos]Artemis!35723C5D6CFA [McAfee]TDSS [McAfee]W32/RLoader.A!tr [Fortinet]Troj/Agent-VVB [Sophos]Trojan.Rloader!inf [Symantec]W32/Backdoor2.HKNO [F-Prot]Backdoor [K7AntiVirus]Generic Rootkit.el [McAfee]
More aliases (389)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%ALLUSERSPROFILE%\Application Data\ARQ5oKqj9YW2bJ.exe

File name: ARQ5oKqj9YW2bJ.exe
Size: 371.71 KB (371712 bytes)
MD5: c31bf1bf01ca7b5f3ea5885d7639c946
Detection count: 66
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: December 12, 2011

%ALLUSERSPROFILE%\Application Data\iNH6CVf5urD3nE.exe

File name: iNH6CVf5urD3nE.exe
Size: 374.78 KB (374784 bytes)
MD5: a2fc02b4f6ed22f16bc2124f83739c21
Detection count: 54
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: December 12, 2011

%ALLUSERSPROFILE%\Application Data\jrzplm1gJUM5NX.exe

File name: jrzplm1gJUM5NX.exe
Size: 371.71 KB (371712 bytes)
MD5: 5b6e473a38c5d66ab9240bfdfc5bd916
Detection count: 54
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: December 12, 2011

%TEMP%\8050.sys

File name: 8050.sys
Size: 292.86 KB (292864 bytes)
MD5: 0e5ed1dc5d8b8f0a030278768b7c10e6
Detection count: 45
File type: System file
Mime Type: unknown/sys
Path: %TEMP%
Group: Malware file
Last Updated: April 12, 2012

%TEMP%\ciphltMC.dll

File name: ciphltMC.dll
Size: 47.1 KB (47104 bytes)
MD5: b9dea8e59258245410cd8b3993e12562
Detection count: 34
File type: Dynamic link library
Mime Type: unknown/dll
Path: %TEMP%
Group: Malware file
Last Updated: December 8, 2011

%TEMP%\8007.sys

File name: 8007.sys
Size: 145.4 KB (145408 bytes)
MD5: 3d1d026ddc1385926dd3a721ab4b287c
Detection count: 34
File type: System file
Mime Type: unknown/sys
Path: %TEMP%
Group: Malware file
Last Updated: November 12, 2012

%TEMP%\8039.sys

File name: 8039.sys
Size: 430.08 KB (430080 bytes)
MD5: a00f501b7134930fceeb8f7a53d9c382
Detection count: 23
File type: System file
Mime Type: unknown/sys
Path: %TEMP%
Group: Malware file
Last Updated: April 13, 2012

%ALLUSERSPROFILE%\Application Data\5v9Vwl60F8Rtgx.exe

File name: 5v9Vwl60F8Rtgx.exe
Size: 374.78 KB (374784 bytes)
MD5: 2c4ba683289f711486a2ce38ddcdb523
Detection count: 15
File type: Executable File
Mime Type: unknown/exe
Path: %ALLUSERSPROFILE%\Application Data
Group: Malware file
Last Updated: December 8, 2011

%WINDIR%\system32\e9bab6b3.exe

File name: e9bab6b3.exe
Size: 40.44 KB (40448 bytes)
MD5: 135c68d0fefa4827f32181a817b11eec
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: October 17, 2012

%WINDIR%\system32\/.exe

File name: /.exe
Size: 53.72 KB (53723 bytes)
MD5: c64780359e707d226006b231620c5643
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: November 4, 2019

%USERPROFILE%\Application Data\setup.exe

File name: setup.exe
Size: 48.02 KB (48028 bytes)
MD5: 8b72db84bb9ef91c7a9f49f8e1d68183
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Application Data
Group: Malware file
Last Updated: September 3, 2021

%COMMONPROGRAMFILES(x86)%\BOONTY Shared\Service\Boonty.exe

File name: Boonty.exe
Size: 69.12 KB (69120 bytes)
MD5: 65676d813a1bee8458738a89203c5f50
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %COMMONPROGRAMFILES(x86)%\BOONTY Shared\Service
Group: Malware file
Last Updated: December 12, 2011

%TEMP%\5728.sys

File name: 5728.sys
Size: 139.52 KB (139520 bytes)
MD5: 1a06c9791693b66fc6557a6c32aaf516
Detection count: 5
File type: System file
Mime Type: unknown/sys
Path: %TEMP%
Group: Malware file
Last Updated: June 26, 2012

%TEMP%\5016.sys

File name: 5016.sys
Size: 151.55 KB (151552 bytes)
MD5: 9538a47443ec5999b490e68b46ab944d
Detection count: 5
File type: System file
Mime Type: unknown/sys
Path: %TEMP%
Group: Malware file
Last Updated: January 24, 2012

%WINDIR%\System32\drivers\Wdf01000.sys

File name: Wdf01000.sys
Size: 503.86 KB (503864 bytes)
MD5: 6ed4faa0734a392d0fa7d78502a68db8
Detection count: 5
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\System32\drivers
Group: Malware file
Last Updated: November 20, 2012

\??\C:\Windows\TEMP\5613.sys

File name: 5613.sys
Size: 165.88 KB (165888 bytes)
MD5: 35723c5d6cfa1166984aac1cb35f6b53
Detection count: 1
File type: System file
Mime Type: unknown/sys
Path: \??\C:\Windows\TEMP
Group: Malware file
Last Updated: March 21, 2013

More files