Malware.AI.1502982179 removal tips

The Malware.AI.1502982179 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.1502982179 virus can do?

Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.1502982179?


File Info:
name: 022D9AAF369EB7D6F283.mlw
path: /opt/CAPEv2/storage/binaries/d5a5c422bc07a377d4187fecc4c9c4d95e02e03244d11a0e1ae380f165d625ad
crc32: 624A770F
md5: 022d9aaf369eb7d6f283832324653e0a
sha1: 7705ee4885d89af8f017a8b3e2080ccf8ec92fc6
sha256: d5a5c422bc07a377d4187fecc4c9c4d95e02e03244d11a0e1ae380f165d625ad
sha512: 5fc341b11c8ef4ca0cbb30c8ea7608da7647f8dc2b7edd707ffd5a35c511d14f7499f94cbbb315bc4618a06ba01bae9dbc4d47e5aee1df51cc3d07c364b8ad6d
ssdeep: 12288:VveuarW8glmsQIhGgcOVN0VJBQ0FAeuxOvGEt:VwUlmsQIR3Mz20FA/5
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T1C26523075B382917F3676A32413B663D782CBB343E50A297E65C349B6E32B50CC6E917
sha3_384: 821c69445d41e83e0e89271b5c361fdf851971f906d617d30a5f91cf4262561c70f578243bb36be6484d8a25b771660c
ep_bytes: e8d0020000e9d9fdffffcccccccccccc
timestamp: 2052-01-25 15:22:43

Version Info:
CompanyName: Microsoft Corporation
FileDescription: x86 Performance Counter Host
FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
InternalName: perfhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: perfhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.1
Translation: 0x0409 0x04b0

Malware.AI.1502982179 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.022d9aaf369eb7d6
McAfee	Artemis!022D9AAF369E
Cybereason	malicious.885d89
Cyren	W32/Expiro.AU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Expiro.CN
Kaspersky	VHO:Trojan.Win32.Convagent.gen
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
APEX	Malicious
Sophos	Generic ML PUA (PUA)
DrWeb	Win32.Expiro.153
McAfee-GW-Edition	BehavesLike.Win32.Emotet.tt
Emsisoft	Win32.Expiro.Gen.7 (B)
Avira	TR/Patched.Gen
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASVirus.317
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	VHO:Trojan.Win32.Convagent.gen
GData	Win32.Expiro.Gen.7
Cynet	Malicious (score: 100)
ALYac	Win32.Expiro.Gen.7
Malwarebytes	Malware.AI.1502982179
Avast	Win32:Vitro [Inf]
Rising	Malware.Heuristic!ET#83% (RDMK:cmRtazqN5yOj1FlNtogmN6YKJEmX)
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Expiro.NDO!tr
AVG	Win32:Vitro [Inf]
CrowdStrike	win/malicious_confidence_70% (W)

How to remove Malware.AI.1502982179?

Malware.AI.1502982179 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X