Virus

What is “Virus:Win32/Expiro.EK!MTB”?

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • Authenticode signature is invalid

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: 330CC1804C4CE4DB082A.mlw
path: /opt/CAPEv2/storage/binaries/ab97a5f16571e935c54fda45f1e660a210a7c55a628749b36c3c50f38db74812
crc32: 823D5AA3
md5: 330cc1804c4ce4db082aee6810d19a6d
sha1: 84ea569a530ccd1ec37e1f8d0f87ce4e2f4f9d8d
sha256: ab97a5f16571e935c54fda45f1e660a210a7c55a628749b36c3c50f38db74812
sha512: df47dc18a205f086dd70428a08904fc1d2386438e176c4415506127b06b509ec731d5ad9c56b500256d357ae2bc4d2e0225282ece40dff0d64bb5bf4e438242b
ssdeep: 24576:EB+4UT1FSeZLme+bKCdqbSXyeQg7FAZjxiz7bOl:8+bxmluWXygahxiz7bu
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10185E0013B518EB6F5A3C17B596A671E662ABD220B10E3C3B3607B5DDC321C5CA3E359
sha3_384: 36d98daa4214c0c0e67ed61876ad3817f97041751af1af550d29705e94071dee21289bb6776477d28b507058a68c116b
ep_bytes: e8660a0000e978feffffcccccccccccc
timestamp: 2020-07-30 23:26:35


Version Info:

CompanyName: Adobe Systems Incorporated
FileDescription: Adobe PDF Broker Process for Internet Explorer
FileVersion: 20.12.20041.394260
InternalName: AcroBroker.exe
LegalCopyright: Copyright 1984-2020 Adobe Systems Incorporated and its licensors. All rights reserved.
OriginalFilename: AcroBroker.exe
ProductName: Adobe PDF Broker Process for Internet Explorer
ProductVersion: 20.12.20041.394260
Translation: 0x0409 0x04e4

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.7
ClamAVWin.Virus.Expiro-9985771-0
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Generic.tt
ALYacWin32.Expiro.Gen.7
MalwarebytesGeneric.Malware.AI.DDS
VIPREWin32.Expiro.Gen.7
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
K7GWVirus ( 005a8b911 )
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDP
APEXMalicious
CynetMalicious (score: 100)
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:FileInfector-C [Heur]
RisingTrojan.Generic@AI.90 (RDML:ehYI/+qcWCLvx1PAyvHbKw)
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-C
IkarusVirus.Win32.Tufik
GoogleDetected
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
MicrosoftVirus:Win32/Expiro.EK!MTB
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
VaristW32/Expiro.AU.gen!Eldorado
Acronissuspicious
TACHYONVirus/W32.Movia
VBA32Trojan.Sabsik.TE
Cylanceunsafe
PandaW32/Moyv.A
TencentVirus.Win32.VirMoiva.a
SentinelOneStatic AI – Malicious PE
FortinetW32/Expiro.NDP!tr
AVGWin32:FileInfector-C [Heur]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment