Should I remove “Malware.AI.1281379089”?

The Malware.AI.1281379089 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.1281379089 virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Malware.AI.1281379089?


File Info:
name: E9B2AE979B5AC17D2438.mlw
path: /opt/CAPEv2/storage/binaries/3a93e67267ca0a3046cc50d6ece400ecd4287ccc3df09daadeaadfdbc4fe9d8a
crc32: 3DAE6D19
md5: e9b2ae979b5ac17d2438eeadd44cbe37
sha1: b8edd3baaddc0c07ac94b51d4192de9a63b30b32
sha256: 3a93e67267ca0a3046cc50d6ece400ecd4287ccc3df09daadeaadfdbc4fe9d8a
sha512: 7493d021e85c4ed983ba700a0ce6522f0865c9773909552ecb617c1a1106c177a0b9e6b403f04c33eaf9b2c192bdfb396a2f5807d41951f96931af21a695cb82
ssdeep: 6144:fMV8qKt/zG0/EDLFtCi8EpJVALText7Y1X8EokQ9+/MTt/0SZwomKgIrTr:fMV6GFDT6aVbSfokQL6PomKt
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FDB48D83735745D0DEB923322AB9FB6BF07D0261DE5C5A0159D4BB3A0878A81E7188DF
sha3_384: b4da0e15f914844410bfc40b986567a8a87aef49a764fc997aa6a28d216c7e32d33ff88445d672653c4e869556f1695f
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2017-08-04 09:10:57

Version Info:
CompanyName: Microsoft Corporation
FileDescription: .NET Runtime Optimization Service
FileVersion: 4.7.2558.0 built by: NET471REL1
InternalName: mscorsvw.exe
LegalCopyright: © Microsoft Corporation.  All rights reserved.
OriginalFilename: mscorsvw.exe
ProductName: Microsoft® .NET Framework
ProductVersion: 4.7.2558.0
Comments: Flavor=Retail
PrivateBuild: DDBLD369D
Translation: 0x0409 0x04b0

Malware.AI.1281379089 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.e9b2ae979b5ac17d
ALYac	Win32.Expiro.Gen.6
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.79b5ac
BitDefenderTheta	Gen:NN.ZexaF.34084.Eu0@aiCcUIpi
Cyren	W32/Expiro.AN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Expiro.NDG
APEX	Malicious
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Avast	Win32:Xpirat-C [Inf]
Ad-Aware	Win32.Expiro.Gen.6
Emsisoft	Win32.Expiro.Gen.6 (B)
VIPRE	Virus.Win32.Expiro.dp (v)
Sophos	ML/PE-A + Mal/EncPk-MK
SentinelOne	Static AI – Malicious PE
Avira	TR/Patched.Gen
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Expiro.Gen.6
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.1281379089
Ikarus	Win32.Infector
Fortinet	W32/Expiro.NDG
AVG	Win32:Xpirat-C [Inf]
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Malware.AI.1281379089?

Malware.AI.1281379089 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X