Virus

Virus:Win32/Expiro.EK!MTB removal tips

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • A file was accessed within the Public folder.
  • CAPE extracted potentially suspicious content
  • Drops a binary and executes it
  • Authenticode signature is invalid
  • Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: 02BBE79234F1FEA3D377.mlw
path: /opt/CAPEv2/storage/binaries/bf2f45b301648af701302daaed37ebee0a29842fc0c17a5e81976aff66bf9aa7
crc32: ED027105
md5: 02bbe79234f1fea3d377a95a91d4256c
sha1: 1a873e80c4f5f7c2662211b13f705be12a6f9cad
sha256: bf2f45b301648af701302daaed37ebee0a29842fc0c17a5e81976aff66bf9aa7
sha512: 17045342dfc537957fec439e12642817c846d837902f6a32e7e114ea88e9b836b9eb71e7fa22e65ba72bdcb1266bfa34c47e3dd45f938f716f2ae445daee2158
ssdeep: 24576:EUU8aS1lTlv8NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:xUpS1lTFgDUYmvFur31yAipQCtXxc0H
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1858502B1B081D0B2D922043585F8DB715A7E7D7859A08E1FA3AC373A4F727D24129DAF
sha3_384: 9d605e1e3ce98c600ef0125199d15777d681e3d46fd85d88f69afcd2c4a6259175ec0a9a37202f982a01f958c6031507
ep_bytes: e8501a1a00e97afeffff558bec6a00ff
timestamp: 2020-12-09 13:07:51


Version Info:

CompanyName: Oracle Corporation
FileDescription: Java(TM) Platform SE binary
FileVersion: 8.0.2810.9
Full Version: 1.8.0_281-b09
InternalName: javaw
LegalCopyright: Copyright © 2020
OriginalFilename: javaw.exe
ProductName: Java(TM) Platform SE 8
ProductVersion: 8.0.2810.9
Translation: 0x0000 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.7
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Generic.tt
MalwarebytesGeneric.Malware/Suspicious
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
K7GWVirus ( 005a8b911 )
Cybereasonmalicious.0c4f5f
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDP
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Trojan.Expiro-9962115-0
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:Vitro [Inf]
TencentVirus.Win32.VirMoiva.a
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-C
IkarusWorm.Win32.Soulclose
GDataWin32.Expiro.Gen.7
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
MicrosoftVirus:Win32/Expiro.EK!MTB
GoogleDetected
Acronissuspicious
VBA32Trojan.Sabsik.TE
ALYacWin32.Expiro.Gen.7
TACHYONVirus/W32.Movia
Cylanceunsafe
PandaW32/Moyv.A
RisingTrojan.Generic@AI.97 (RDML:zwtdaKNYzEg8jqV/gV2PWA)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:Vitro [Inf]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment