What is “Virus:Win32/Expiro.EK!MTB”?

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: EC4F741A9EB18649891D.mlw
path: /opt/CAPEv2/storage/binaries/fe007073eb5d322e3c8b56bbde3690358bd8262a14e8a7aa2396ff3d636a7c73
crc32: 5E5975D1
md5: ec4f741a9eb18649891d1276ef101dab
sha1: 850cc3159f41feb5001c8523f28547715f9696fd
sha256: fe007073eb5d322e3c8b56bbde3690358bd8262a14e8a7aa2396ff3d636a7c73
sha512: e217cdd71862a31e4380de7fb3f21baf1861d06f6f70b71f38927f82f35c25839a05af6d8a598a9e4390ab8bbb6ae86ff9ad3a4ef8639e7719a12bb53d5249fc
ssdeep: 24576:+fGxypd+RPWxNs298r3OCDIjG3gE9ow+8xA+:gGApd+R+ft983Dl3gEe8xA+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17A75011039C0D0B3D977057049B4E6B1A53EFE342FB419EBA3901B6A9E742D29E34A77
sha3_384: 26262e4a051d27d5e36b41ae1fb3f32ff4b8280058fe42b709bfcd6fedef9967fa73203235a33ddbed65de5b75d8442e
ep_bytes: e838050000e978feffffcccccccccccc
timestamp: 2020-09-06 09:09:42

Version Info:
CompanyName: Adobe Inc.
FileDescription: Adobe Acrobat Update Service
FileVersion: 1.824.39.9311
InternalName: armsvc.exe
LegalCopyright: Copyright © 2020 Adobe Inc. All rights reserved.
OriginalFilename: armsvc.exe
ProductName: Adobe Acrobat Update Service
ProductVersion: 1.824.39.9311
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.