Virus

How to remove “Virus:Win32/Expiro.EK!MTB”?

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: B8356D54A37B35D83DB1.mlw
path: /opt/CAPEv2/storage/binaries/18de5a20d70725c221a2b009e21582b6d0a678b6cb20d65c6148d4971b4509aa
crc32: B5ACE904
md5: b8356d54a37b35d83db15609a58330ba
sha1: 4a3e4e1fafdaa4136e2d48041aa5659ae9b9c076
sha256: 18de5a20d70725c221a2b009e21582b6d0a678b6cb20d65c6148d4971b4509aa
sha512: 994d7ed5ce6c17db00b35e08f4916028d54cabb12b6f94a0557ecd88897ca6bdfabfe69d6264586d000dcbe16ba24be0f71cef451c4ebd8b4c9218ebddcd8877
ssdeep: 24576:zVRbdWLDWHRlMugdD+JsRgZRJ4fM430Eg6nET7M/IiN:xhdWmxlMPdlR8v4UC0Eg6ET7M/I
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C4850152B645A0B0C95B27766C1FEB3AC7344E09171605C3E3E02F6BEE287D46877A4E
sha3_384: 7ef6e5a4af1084d556333e5b91674a69130aeeef663a56f70c13dd92a6308f317c14298743f5fd45a73524dcfc96ce5d
ep_bytes: e805000000e978feffff8b0d0c004300
timestamp: 2021-11-03 15:18:26


Version Info:

Comments: 
LegalCopyright: License: MPL 2
CompanyName: Mozilla Foundation
FileDescription: 
FileVersion: 94.0.1
ProductVersion: 94.0.1
InternalName: 
LegalTrademarks: Mozilla
OriginalFilename: crashreporter.exe
ProductName: Firefox
BuildID: 20211103134640
Translation: 0x0000 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
DrWebWin32.Expiro.158
MicroWorld-eScanWin32.Expiro.Gen.7
ClamAVWin.Trojan.Generic-9935365-0
FireEyeGeneric.mg.b8356d54a37b35d8
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Sality.tt
MalwarebytesGeneric.Malware/Suspicious
SangforTrojan.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
AlibabaVirus:Win32/Expiro.fd098080
K7GWVirus ( 005a8b911 )
Cybereasonmalicious.fafdaa
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDP
APEXMalicious
CynetMalicious (score: 100)
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:FileInfector-C [Heur]
TencentVirus.Win32.VirMoiva.a
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-C
SentinelOneStatic AI – Malicious PE
GDataWin32.Expiro.Gen.7
GoogleDetected
AviraW32/Infector.Gen
MAXmalware (ai score=80)
Antiy-AVLVirus/Win32.Expiro.x
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
MicrosoftVirus:Win32/Expiro.EK!MTB
VaristW32/Expiro.AU.gen!Eldorado
AhnLab-V3Malware/Win.IS.C5064324
VBA32Trojan.Sabsik.TE
ALYacWin32.Expiro.Gen.7
TACHYONVirus/W32.Movia
Cylanceunsafe
PandaW32/Moyv.A
RisingTrojan.Generic@AI.80 (RDML:yLcN5kN8TJi8s5w7Y9ORtw)
IkarusVirus.Win32.Expiro
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/FileInfector.C!tr
AVGWin32:FileInfector-C [Heur]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment