About “Virus:Win32/Expiro.BM” infection

The Virus:Win32/Expiro.BM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.BM virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Virus:Win32/Expiro.BM?

File Info:
name: B7A7785E007144F2E83C.mlw
path: /opt/CAPEv2/storage/binaries/77086cfcd49e2ea56b94f87fc7f80d5e53416a1b1935af81a78556c8f75ae937
crc32: 56D01558
md5: b7a7785e007144f2e83c11f1fb953cfc
sha1: 0a8a8454afd22e2bcfae392160e476769ee76366
sha256: 77086cfcd49e2ea56b94f87fc7f80d5e53416a1b1935af81a78556c8f75ae937
sha512: 7623915dfbae1c4b5f312cb8b03c5f8038b83ad8b708860a85c2116d735f6465e660b19bc004b8eed58fb2598f1d5af2946a9b9154d27d5b7d6a260fac784ef2
ssdeep: 6144:Bm9RwYkaR7BRvMpPI34bGemiNIJYRNvSeoWPP8+O+OZ5yZfkuQzfH0K7Rx0Pz0/f:sRwu+BkcGemiNIJYy+PjUx0Pz0/ES
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T113C45B105456CD0EE1F2DCFB20B12A00F32E9A88F6FB01A5C265E7ED5E6D4912E99F53
sha3_384: 517e119887430b3f9e101afdd1d0d0c82e50170918c80c799dfbeae6a95e7ea83ceef63ade9d3822ad384728fe5cbfca
ep_bytes: 50905152905390545556575589e583ec
timestamp: 2004-08-04 05:59:44

Version Info:
CompanyName: Microsoft Corporation
FileDescription: NetMeeting Remote Desktop Sharing
FileVersion: 5.1.2600.2180
InternalName: mnmsrvc
LegalCopyright: Copyright © Microsoft Corporation 1996-2001
LegalTrademarks: Microsoft® is a registered trademark of Microsoft Corporation. Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: mnmsrvc.dll
ProductName: Windows® NetMeeting®
ProductVersion: 3.01
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.BM also known as:

How to remove Virus:Win32/Expiro.BM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.