Categories: Virus

Should I remove “Virus.Win32.Expiro.ob”?

The Virus.Win32.Expiro.ob is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus.Win32.Expiro.ob virus can do?

Behavioural detection: Executable code extraction – unpacking
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Virus.Win32.Expiro.ob?


File Info:
name: 59FDE0D6A147EC2A4BA0.mlwpath: /opt/CAPEv2/storage/binaries/d89806676981b2c4b108e6fba487080750788952b10c27411b67c68368987e53crc32: 4B97AA9Fmd5: 59fde0d6a147ec2a4ba03036e2ae098asha1: 8e05135f030b9aeffe80ea49c006cef3b0573549sha256: d89806676981b2c4b108e6fba487080750788952b10c27411b67c68368987e53sha512: 2246ce2e2ef21ac021399beba117d230c084f0a47d872bb88c61c62c852f7b3dcb05ec316b26c47b776798eca2e208c42064e1af91a0beb1438d7f3f5bb2be0essdeep: 12288:WxLVMsCpn5K6hqL7JtLFIv/8YPRsK14ZzYjnxUKU8:WxLYi6huwUPKeIntype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T11CA4B0303550B23DF8D661F08D4EB231F5AE99746B2483C773B45AEDA864BC19A3429Fsha3_384: c4fe2f465aedf44b3de48ffb425d094403324c5f38e3bdfbb0bbf489b1ea5b3c40b44979eb275982370ce2cc9d9b635fep_bytes: 5253562bd283c218648b1a01d201da8btimestamp: 2004-12-22 06:19:53
Version Info:
CompanyName: Microsoft Corp., Veritas SoftwareFileDescription: Logical Disk Manager service processFileVersion: 2600.2180.503.0InternalName: dmadminLegalCopyright: Copyright © 1985-2000 Microsoft Corporation.  All rights reserved. 
Portions Copyright © 1997-2000 Veritas Software.  All rights reserved.OriginalFilename: dmadmin.exeProductName: Logical Disk Manager for Windows NTProductVersion: 1.0Translation: 0x0409 0x04e4

Virus.Win32.Expiro.ob also known as:

Bkav	W32.Expiro2NHc.PE
Lionic	Virus.Win32.Expiro.n!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.6
FireEye	Generic.mg.59fde0d6a147ec2a
ALYac	Win32.Expiro.Gen.6
Cylance	Unsafe
K7AntiVirus	Virus ( 00580a951 )
Alibaba	Virus:Win32/Expiro.2df6c1d6
K7GW	Virus ( 0052ed0c1 )
Cybereason	malicious.6a147e
Cyren	W32/Expiro.CC
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Expiro.NCW
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Virus.Expiro-6963725-0
Kaspersky	Virus.Win32.Expiro.ob
BitDefender	Win32.Expiro.Gen.6
NANO-Antivirus	Virus.Win32.Gen.ccmw
Tencent	Win32.Virus.Expiro.Szvx
Ad-Aware	Win32.Expiro.Gen.6
TACHYON	Virus/W32.Expiro.D
Emsisoft	Win32.Expiro.Gen.6 (B)
Comodo	Virus.Win32.Expiro.NCW@89m86e
DrWeb	Win32.Expiro.144
VIPRE	Virus.Win32.Expiro.dp (v)
McAfee-GW-Edition	BehavesLike.Win32.Fareit.gc
Sophos	Mal/Generic-R + W32/Expiro-AV
SentinelOne	Static AI – Malicious PE
GData	Win32.Expiro.Gen.6
Avira	W32/Infector.Gen8
Antiy-AVL	Trojan/Generic.ASVirus.2F9
Arcabit	Win32.Expiro.Gen.6
ZoneAlarm	Virus.Win32.Expiro.rd
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	Artemis!59FDE0D6A147
VBA32	BScope.Trojan.Packed
Rising	Virus.Expiro!8.375 (CLOUD)
Ikarus	Expiro.Win32
Fortinet	W32/Expiro.NCW
BitDefenderTheta	AI:FileInfector.1CD444C412
CrowdStrike	win/malicious_confidence_100% (W)