Threat Database Trojans HackTool:Win32/Evidpatch.A

HackTool:Win32/Evidpatch.A

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 18
First Seen: September 10, 2012
Last Seen: May 5, 2020
OS(es) Affected: Windows

HackTool:Win32/Evidpatch.A is a malicious tool detected by Microsoft's security software. It is a type of malware that can cause significant damage to a computer system by modifying and manipulating system files, leading to various system issues and potential data breaches.

What Is HackTool:Win32/Evidpatch.A?

HackTool:Win32/Evidpatch.A is a specific detection name given by Microsoft to a type of malware that has been identified as a hacking tool. The name "Evidpatch" suggests that this malware is related to patching or modifying evidence of the malware's presence on the system, potentially making it harder to detect. The "A" in the name indicates that it is a specific variant of the Evidpatch malware.

How HackTool:Win32/Evidpatch.A Operates

HackTool:Win32/Evidpatch.A operates by infiltrating a system and making unauthorized changes to system files. This can lead to system instability, data corruption, and potentially allow the malware to evade detection by modifying its own footprint on the system. The exact operation mechanism can vary, but the primary goal of such malware is to provide unauthorized access or to prepare the system for further malicious activities.

Symptoms of Infection

Symptoms of infection by HackTool:Win32/Evidpatch.A can include system crashes, unexpected restarts, or the system becoming unresponsive. Additionally, the presence of this malware can be indicated by the detection of the malware itself by security software. In some cases, the system may behave erratically, or certain programs may not function correctly due to the modifications made by the malware.

How to Remove HackTool:Win32/Evidpatch.A

Removing HackTool:Win32/Evidpatch.A involves several steps to ensure the system is thoroughly cleaned and restored to its original state. Here are the steps to follow:

  1. Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
  2. Perform a full scan with a reputable anti-malware tool such as SpyHunter to detect and remove all instances of the malware.
  3. Uninstall any programs that are identified as suspicious or malicious, as they might be related to the HackTool:Win32/Evidpatch.A infection.
  4. Reset the settings of browsers like Chrome, Firefox, or Edge to their default state, as the malware might have altered these settings for malicious purposes.
  5. Reboot the system and perform another scan to ensure that all remnants of the malware have been removed.

Conclusion

HackTool:Win32/Evidpatch.A is a significant threat to system security and integrity. Its ability to modify system files and evade detection makes it a dangerous piece of malware. By understanding how it operates and following the steps to remove it, users can protect their systems from its harmful effects and restore their systems to a safe and secure state. It is crucial to remain vigilant and use reputable security software to detect and remove such malware before it causes significant damage.

Aliases

15 security vendors flagged this file as malicious.

Antivirus Vendor Detection
Panda Suspicious file
AVG Agent3.BXWR
Ikarus Trojan.Win32.Webprefix
BitDefender Gen:Variant.Zusy.15436
Panda Generic Trojan
AVG Dropper.Generic6.AUKS
Fortinet W32/Jorik_Totem.WB!tr
Ikarus Trojan-Dropper
AntiVir TR/Dropper.Gen
Comodo UnclassifiedMalware
Kaspersky Trojan.Win32.Jorik.Totem.wb
Avast Win32:Trojan-gen
Symantec W32.Pilleuz
McAfee Generic Dropper!1w3
CAT-QuickHeal Trojan.Jorik.Totem.wb

File System Details

HackTool:Win32/Evidpatch.A may create the following file(s):
# File Name MD5 Detections
1. rearokwipame.exe 709ca81c59ad5642ebc11ecbd59b6762 12
2. eChanblard.exe 631ffabc057e2fcaf3c5fbc507da7a89 3
3. csrssr.exe e2c23b3ec0828cf4bcc2ee58371ad12e 2