Malware

Malware.AI.2928052973 removal instruction

Malware Removal

The Malware.AI.2928052973 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.2928052973 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Malware.AI.2928052973?


File Info:

name: AF2EF8EE8E8F3DCE72B9.mlw
path: /opt/CAPEv2/storage/binaries/5282beb7358a252ed8a187b8abc9097bf4e1f1e571578748d753a6aa1df47ee6
crc32: 4691FEA0
md5: af2ef8ee8e8f3dce72b9236d992e64ad
sha1: 2d76b61bbe74b2e2a5333f4ea8d1a84db3ebf5d9
sha256: 5282beb7358a252ed8a187b8abc9097bf4e1f1e571578748d753a6aa1df47ee6
sha512: 9873204186572bbc6086075292b1906b83d483e533be6c50960677db5ac6ef101b7547c15aded669561c2e75b58fb7e836959b0d8bb9681176b888895b3a98d3
ssdeep: 12288:w+S/n6JWeGoi1dSJVFuH1d+abgwA3FuJE1:7S4VUH1Qa+7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T168B48C83634B35C4DFB921731A7AFB08A0F906A5DED49A435DD9783608B8B8137788DD
sha3_384: 7759e4afc1074dcfbfc1fde4b542172ee32d889fcd47c2940de26182236b95059949f6fe57eb36cb93c9cfa83531edc8
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2009-05-09 10:01:56

Version Info:

CompanyName: Microsoft Corporation
FileDescription: Windows Font Viewer
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: fontview
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: FONTVIEW.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Malware.AI.2928052973 also known as:

BkavW32.Expiro2NHc.PE
CynetMalicious (score: 100)
FireEyeGeneric.mg.af2ef8ee8e8f3dce
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 0058dc741 )
K7GWVirus ( 0058dc741 )
CrowdStrikewin/malicious_confidence_100% (D)
VirITWin32.Expiro.CV
CyrenW32/S-4937f068!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Expiro.CP
APEXMalicious
ClamAVWin.Virus.Expiro-9936168-0
KasperskyVirus.Win32.Expiro.ns
BitDefenderWin32.Expiro.Gen.6
NANO-AntivirusVirus.Win32.Gen.ccmw
MicroWorld-eScanWin32.Expiro.Gen.6
AvastWin32:Xpirat-C [Inf]
EmsisoftWin32.Expiro.Gen.6 (B)
DrWebWin32.Expiro.150
TrendMicroVirus.Win32.EXPIRO.AD
SophosML/PE-A + Mal/EncPk-MK
IkarusVirus.Win32.Expiro
JiangminTrojan.PSW.Stealer.abj
AviraTR/Patched.Gen
Antiy-AVLTrojan/Generic.ASVirus.315
MicrosoftTrojan:Win32/Raccoon.EC!MTB
ZoneAlarmVirus.Win32.Expiro.ns
GDataWin32.Expiro.Gen.6
ALYacWin32.Expiro.Gen.6
MAXmalware (ai score=80)
VBA32BScope.Trojan.Wacatac
MalwarebytesMalware.AI.2928052973
TrendMicro-HouseCallVirus.Win32.EXPIRO.AD
SentinelOneStatic AI – Malicious PE
FortinetW32/Expiro.NDG
AVGWin32:Xpirat-C [Inf]
Cybereasonmalicious.e8e8f3

How to remove Malware.AI.2928052973?

Malware.AI.2928052973 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment