BKDR_SIMBOT.EVL Description

BKDR_SIMBOT.EVL is a dangerous backdoor Trojan. BKDR_SIMBOT.EVL is often used to install other malware on the victim’s computer, with the purpose of taking over the infected computer system and controlling it from a remote location. BKDR_SIMBOT.EVL is associated with TROJ_PPDROP.EVL, a Trojan dropper that is disguised as a PowerPoint file. BKDR_SIMBOT.EVL will rarely display overt symptoms and is designed to operate in the background without the victim’s knowledge. Although prevention is the best measure when it comes to BKDR_SIMBOT.EVL it is important to use a reliable, fully-updated anti-malware program to scan your computer system if you suspect that you have been exposed to this dangerous Trojan.

BKDR_SIMBOT.EVL is Designed to Undermine Your Computer System’s Security

A BKDR_SIMBOT.EVL infection will usually begin with an email spam message. This email message will contain an attachment that is marked as a PowerPoint file. However, it is actually a Trojan dropper that contains an embedded corrupt Flash file. It uses a well-known Adobe software vulnerability in order to install BKDR_SIMBOT.EVL and a real PowerPoint presentation designed to distract the victim. Most of the time, it is possible to avoid this infection merely by keeping your Adobe software fully updated. Once installed, BKDR_SIMBOT.EVL injects its malicious code into running system file processes, making its detection considerably more difficult than with Trojans that use independent executable files.

BKDR_SIMBOT.EVL can be used to carry out various kinds of attacks on your computer system. There are many problems associated with BKDR_SIMBOT.EVL. Among these, the most prominent include the following:

1. If your computer system is showing an unusually high usage of system resources and a decrease in performance, this may be a symptom of BKDR_SIMBOT.EVL or another malware infection.
2. BKDR_SIMBOT.EVL will rarely be a standalone infection. Most of the time, BKDR_SIMBOT.EVL is used to deliver other malware into the victim’s computer system. Because of this, most BKDR_SIMBOT.EVL infections are detected because of other malware present on the infected PC.
3. BKDR_SIMBOT.EVL will connect without the computer user’s authorization to a remote server. This will often happen through ports 80 and 443. Unauthorized network traffic on these ports may indicate that BKDR_SIMBOT.EVL is transferring stolen data from your computer system or receiving commands from a remote server.

If you suspect that your computer system has become infected with BKDR_SIMBOT.EVL, ESG security analysts strongly advise starting up Windows in Safe Mode and running a full system scan with a reliable, fully-updated anti-malware program.

Type: Backdoors

How Can You Detect BKDR_SIMBOT.EVL?

BKDR_SIMBOT.EVL Removal Details

BKDR_SIMBOT.EVL has typically the following processes in memory:

• %UserProfile%\Local Settings\{random filename}.exe

BKDR_SIMBOT.EVL creates the following registry entries:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run {random filename} = “%User Profile%\local settings\{random file name}.exe”

Important Article Disclaimer