Virus:Win32/Expiro.EK!MTB information

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: B98900C35B0F867E0581.mlw
path: /opt/CAPEv2/storage/binaries/d1a2ab584e0319ea7ee92bc78eda3322e2250b8e9968e37f2d0f4e0634fe7df8
crc32: 92D3012A
md5: b98900c35b0f867e0581b7a1265dee03
sha1: 18af4b00e79f15c6d2abae3e7d8323388817ca26
sha256: d1a2ab584e0319ea7ee92bc78eda3322e2250b8e9968e37f2d0f4e0634fe7df8
sha512: 80a620b519d4d601d8f5b4abb86e261b86e1754bf752de46f8bc0174dded345f3ae94d8a96e0e0f4c9ce56a6b3be8cac508800ad2f1f4b5caba8b8cf2b5164a2
ssdeep: 12288:u2pI7d0NxksRpWE9FRHSfNm1wgbIxnBw7dzE+e3gxZC6LgjigDy5fdv8fWi+:fpICks7WE9F5pwg8zmdqQjC60jiHkU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16A652260B3821893FB0603358DEAFBA515BC7E61EC985607F5C8771F2CB46E8E854A53
sha3_384: b551a0998baa150335f8673ae51053faec483fb3d9245e2b8b07438be2941d421d71db5bc3f2e01c24e373ea1a042483
ep_bytes: e823fcffffe935fdffff538a5c2408f6
timestamp: 2006-10-27 02:52:16

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft Script Editor
FileVersion: 12.0.4518.1014
InternalName: MSE
LegalCopyright: © 2006 Microsoft Corporation.  All rights reserved.
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: mse.exe
ProductName: 2007 Microsoft Office system
ProductVersion: 12.0.4518.1014
Translation: 0x0000 0x04e4

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.