Virus

About “Virus:Win32/Expiro.EK!MTB” infection

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: 2676B035AF6094A4C663.mlw
path: /opt/CAPEv2/storage/binaries/45fd8e43009b699bd1f867980ebd090bb08353ef7e8072f53a1c10a164ceae51
crc32: 34611EAF
md5: 2676b035af6094a4c663c0a00a8e833e
sha1: 1332434de853b3fe526efa41bbb7f5f8bcbb7568
sha256: 45fd8e43009b699bd1f867980ebd090bb08353ef7e8072f53a1c10a164ceae51
sha512: 1630d2b0a5bfe1bb87dd1ed1fecd8acbf053c7b1a1bf4ac153b08e0eb979daceb295abd6ffbb89800ecc832b67664157da0311888be0d88424a1b16fc979a240
ssdeep: 24576:rB+4UT1FSYZLB7ozX0j52pMkuLoiSJVlIL29mhNq6:l+Zx670jIpM3kiSBM29mhNq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16905E1013F518EB6F5A2C07B197AA71E162ABE265B11D2D3B3606B5CC8321C5CE3E359
sha3_384: 98d015f2e3e3972b88a6d502565e0a13a84a1e4b7a55e9e6ae6c17b9a217bd6a2b7936a48c4f12965208aa0035dc0467
ep_bytes: e85b020a00e978feffffcccccccccccc
timestamp: 2020-07-30 23:26:35


Version Info:

CompanyName: Adobe Systems Incorporated
FileDescription: Adobe PDF Broker Process for Internet Explorer
FileVersion: 20.12.20041.394260
InternalName: AcroBroker.exe
LegalCopyright: Copyright 1984-2020 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename: AcroBroker.exe
ProductName: Adobe PDF Broker Process for Internet Explorer
ProductVersion: 20.12.20041.394260
Translation: 0x0409 0x04e4

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
DrWebWin32.Expiro.158
MicroWorld-eScanWin32.Expiro.Gen.7
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Sality.cc
MalwarebytesGeneric.Malware.AI.DDS
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
K7GWVirus ( 005a8b911 )
SymantecW32.Xpiro.J!dam
ESET-NOD32Win32/Expiro.CU
CynetMalicious (score: 100)
APEXMalicious
ClamAVWin.Virus.Expiro-9944772-0
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:Evo-gen [Trj]
TencentVirus.Win32.VirMoiva.a
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-C
IkarusVirus.Win32.Tufik
GDataWin32.Expiro.Gen.7
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
Kingsoftmalware.kb.a.800
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
MicrosoftVirus:Win32/Expiro.EK!MTB
VaristW32/Expiro.AU.gen!Eldorado
Acronissuspicious
VBA32Trojan.Sabsik.TE
ALYacWin32.Expiro.Gen.7
TACHYONVirus/W32.Movia
Cylanceunsafe
PandaW32/Moyv.A
RisingTrojan.Generic@AI.90 (RDML:7l9TYONSbij6eH2GzXGksg)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:Evo-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment