Malware.AI.4092001958 removal guide

The Malware.AI.4092001958 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Malware.AI.4092001958 virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine Malware.AI.4092001958?


File Info:
name: 811A42B1AE623D8F9DD0.mlw
path: /opt/CAPEv2/storage/binaries/c56f7772d9cbefe60955a9fd54c940e2a99a993498e6b49655e9100751b7172a
crc32: 72064886
md5: 811a42b1ae623d8f9dd0eb57c3730b9a
sha1: 35f3c202c293dc68804489440def80a83caa795b
sha256: c56f7772d9cbefe60955a9fd54c940e2a99a993498e6b49655e9100751b7172a
sha512: df44cdd2cc51b25efb87aaed3c9eaf6a089481b0a2b6970aff5d36180f00277c20afa5a71f9e72ae5c30a5c725e1f9958ac9b6e3e1e6b26f814516837b6f3c0f
ssdeep: 12288:vYQqLWbVTTUVS0VKX8cSYm9cHN5H1dCTD+:vYJLCVMemINF7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13FC48D67F21074CCC12E5F3835D9A9B08994EE502216942AECAF3B7A16FC79743789C7
sha3_384: 1494041195c3cd5080010fcbedb76273485725d58fc2e91d566bbc5af50a3722738cb05b93edb8d0e2908ab7c0cdcf8a
ep_bytes: 5653522bf683c630648b1e518b4b084b
timestamp: 2105-11-13 10:00:33

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows Media Player
FileVersion: 12.0.18362.449 (WinBuild.160101.0800)
InternalName: wmplayer.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: wmplayer.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 12.0.18362.449
Translation: 0x0409 0x04b0

Malware.AI.4092001958 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.811a42b1ae623d8f
ALYac	Win32.Expiro.Gen.6
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Virus ( 00580a951 )
K7AntiVirus	Virus ( 00580a951 )
BitDefenderTheta	AI:Packer.B8B1FCC420
Cyren	W32/Expiro.CG
ESET-NOD32	a variant of Win32/Expiro.CP
APEX	Malicious
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Ad-Aware	Win32.Expiro.Gen.6
Emsisoft	Win32.Expiro.Gen.6 (B)
F-Secure	Malware.W32/Infector.Gen8
TrendMicro	Virus.Win32.EXPIRO.AD
McAfee-GW-Edition	BehavesLike.Win32.Virut.hc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Virus.Win32.Expiro
Jiangmin	Backdoor.Manuscrypt.l
Avira	W32/Infector.Gen8
MAX	malware (ai score=87)
Arcabit	Win32.Expiro.Gen.6
GData	Win32.Expiro.Gen.6
Cynet	Malicious (score: 100)
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Malware.AI.4092001958
TrendMicro-HouseCall	Virus.Win32.EXPIRO.AD
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Xpirat.C
Cybereason	malicious.1ae623

How to remove Malware.AI.4092001958?

Malware.AI.4092001958 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X