Malware.AI.101087069 removal tips

The Malware.AI.101087069 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.101087069 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.101087069?


File Info:
name: 0AB04139182794D9BD89.mlw
path: /opt/CAPEv2/storage/binaries/87c6653cfee52de41ff072e7e974844f7d65b2cc77ecb64adddb893eb5f328f0
crc32: 8669B2E2
md5: 0ab04139182794d9bd89f5d29f6615f2
sha1: 404f63fbf984170d8d55a9aec0155a0ff94f2039
sha256: 87c6653cfee52de41ff072e7e974844f7d65b2cc77ecb64adddb893eb5f328f0
sha512: 5f8b7f9636887afe6ca9f744e8ae77c74386ccbf48d9cafe885ff407973efa68f4f25510a599763a216340dcea952d0a60f1557840ad31a13740a6c0b6b60963
ssdeep: 12288:n16fxZhihZxx1HShX91nOVlNh3f/nyJctqu9:n1UHhSZxx1HS71OnNV/r
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T1E0256B21B7F519C9D272D23995BF54D3E633B4112B35F68B2119C00E1EB76D8AA3B322
sha3_384: 23b1d8d961210c6334d3ce37ad4eb734f151b51481f2e0817bba53c0e38973deb4f66b8c994ea5db5a7137b8f3187a58
ep_bytes: 475150455243b96000000065498b0145
timestamp: 2081-04-29 19:01:53

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Virtual Disk Service
FileVersion: 10.0.17134.1 (WinBuild.160101.0800)
InternalName: vds.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: vds.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.17134.1
Translation: 0x0409 0x04b0

Malware.AI.101087069 also known as:

Elastic	malicious (high confidence)
DrWeb	Win64.Expiro.132
MicroWorld-eScan	Win64.Expiro.Gen.6
ALYac	Win64.Expiro.Gen.6
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Virus ( 00535e4a1 )
K7GW	Virus ( 00535e4a1 )
Cyren	W64/Expiro.AH.gen!Eldorado
ESET-NOD32	a variant of Win64/Expiro.CO
TrendMicro-HouseCall	Virus.Win64.EXPIRO.MR
ClamAV	Win.Virus.Ulise-9879616-0
Kaspersky	HEUR:Virus.Win64.Expiro.gen
BitDefender	Win64.Expiro.Gen.6
Avast	Win64:Xpirat [Inf]
Ad-Aware	Win64.Expiro.Gen.6
Sophos	ML/PE-A + W64/Expiro-AX
TrendMicro	Virus.Win64.EXPIRO.MR
FireEye	Generic.mg.0ab04139182794d9
Emsisoft	Win64.Expiro.Gen.6 (B)
SentinelOne	Static AI – Suspicious PE
GData	Win64.Expiro.Gen.6
Jiangmin	Trojan.Bingoml.akq
Avira	TR/Patched.Gen
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Generic.ASVirus.30B
Arcabit	Win64.Expiro.Gen.6
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.101087069
APEX	Malicious
Ikarus	Virus.Win64.Expiro
MaxSecure	virus.win64.expiro.gen
Fortinet	W64/Expiro.BS
AVG	Win64:Xpirat [Inf]
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Malware.AI.101087069?

Malware.AI.101087069 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X