Malware

Mal/Generic-R + W32/Expiro-S removal guide

Malware Removal

The Mal/Generic-R + W32/Expiro-S is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Mal/Generic-R + W32/Expiro-S virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Mal/Generic-R + W32/Expiro-S?



File Info:

name: F37143FB21EB64F4876C.mlw
path: /opt/CAPEv2/storage/binaries/5e3920adfde3be91915e57cd4001239ac14c2c6719888d8073fa8af0f8684bd1
crc32: C3B4C610
md5: f37143fb21eb64f4876c1f02fb8c976e
sha1: d70d919ed350a0fba29ff31a8ea5b6446333d69f
sha256: 5e3920adfde3be91915e57cd4001239ac14c2c6719888d8073fa8af0f8684bd1
sha512: 60421dd027ef9e4c8571c653957b59b954b54a9e59d58df01e48839f5c9de0da86ed2312897648bc2c119b81ae8c48657fe9cc4b7b7d9213683cf240b431d1e2
ssdeep: 12288:xWavq55bCu/PFshkzQ5dQYo4FDfj6Gh7kkAkpMApTjQIpYrygKzM3gRaf:xWaveOmsCEImFDfd7bSApoMjgKzM8a
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E8E48E946581797AD6B5757E10FF33FAEC6B2E39432A818F51EC1D0E872A5C07D88223
sha3_384: aaa4f62fbcd2ef1997e7db998b6eb58a4d6c9d7b2cc701635518155bfc88bd47813045b2cc58fe4184a4614ee8677a8b
ep_bytes: 605589e581ec08010000c745f40a0000
timestamp: 2012-07-09 03:53:52


Version Info:

CompanyName: Microsoft Corporation
FileDescription: .NET Runtime Optimization Service
FileVersion: 4.0.30319.17929 built by: FX45RTMREL
InternalName: mscorsvw.exe
LegalCopyright: © Microsoft Corporation.  All rights reserved.
OriginalFilename: mscorsvw.exe
ProductName: Microsoft® .NET Framework
ProductVersion: 4.0.30319.17929
Comments: Flavor=Retail
PrivateBuild: DDBLD118
Translation: 0x0409 0x04b0

Mal/Generic-R + W32/Expiro-S also known as:

BkavW32.Expiro2NHc.PE
LionicVirus.Win32.Expiro.lVUO
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.3
FireEyeGeneric.mg.f37143fb21eb64f4
CAT-QuickHealW32.Expiro.L4
ALYacWin32.Expiro.Gen.3
CylanceUnsafe
ZillyaVirus.Expiro.Win32.41
SangforSuspicious.Win32.Save.a
K7AntiVirusVirus ( 0040f4dc1 )
AlibabaVirus:Win32/Expiro.bcf963aa
K7GWVirus ( 0040f4dc1 )
Cybereasonmalicious.b21eb6
BitDefenderThetaAI:FileInfector.6CBEB04B12
CyrenW32/Expiro.BJ
SymantecW32.Xpiro.F
ESET-NOD32a variant of Win32/Expiro.NBZ
BaiduWin32.Virus.Expiro.c
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Virus.Expiro-9632139-0
KasperskyVirus.Win32.Expiro.ar
BitDefenderWin32.Expiro.Gen.3
NANO-AntivirusVirus.Win32.Expiro.clnvwd
AvastWin32:Xpirat [Inf]
TencentVirus.Win32.Expiro.tt
Ad-AwareWin32.Expiro.Gen.3
EmsisoftWin32.Expiro.Gen.3 (B)
ComodoTrojWare.Win32.Spy.Zbot.AAZ@1p8hml
DrWebWin32.Expiro.80
VIPREVirus.Win32.Expiro.p (v)
TrendMicroPE_EXPIRO.AR
McAfee-GW-EditionBehavesLike.Win32.Virut.jc
SophosMal/Generic-R + W32/Expiro-S
IkarusVirus.Win32.Expiro
GDataWin32.Expiro.Gen.3
AviraW32/Expiro.NS
MAXmalware (ai score=83)
Antiy-AVLTrojan/Generic.ASVirus.C5
GridinsoftRansom.Win32.Zbot.sa
ArcabitWin32.Expiro.Gen.3
MicrosoftVirus:Win32/Expiro.CI
CynetMalicious (score: 100)
AhnLab-V3Win32/Expiro5.Gen
Acronissuspicious
McAfeeW32/Expiro.gen.p
VBA32BScope.Trojan.Vilsel
TrendMicro-HouseCallPE_EXPIRO.AR
RisingVirus.Expiro!1.A140 (CLASSIC)
SentinelOneStatic AI – Malicious PE
eGambitUnsafe.AI_Score_96%
FortinetW32/Expiro.W
AVGWin32:Xpirat [Inf]
PandaW32/Expiro.O
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Mal/Generic-R + W32/Expiro-S?

Mal/Generic-R + W32/Expiro-S removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment