Should I remove “Virus:Win32/Expiro.EK!MTB”?

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Arabic (Syria)
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: 9BBCC82FE6D7DD24ED4E.mlw
path: /opt/CAPEv2/storage/binaries/2145012c8b475a0fe91431747ab00e9fcc86d5cad99aeab4b3b54b38eaa7438b
crc32: 89DC4AA1
md5: 9bbcc82fe6d7dd24ed4e4fe40f8d5d77
sha1: 474b62bed672429eed22b1224ce1a5dd62d4c082
sha256: 2145012c8b475a0fe91431747ab00e9fcc86d5cad99aeab4b3b54b38eaa7438b
sha512: 486a8d692ee46cfb596adf3b4c785368e0474ca9e1ef3556c42c7448fc9cf01e732130a001e25e13cc1845a45ca504b4921b4c84df3b6eaa21e8bacba2f86560
ssdeep: 24576:G7zNkhm5PBXWAwP2LzL651RVh2wyhd8d:mNEm5ZXrwP2vLoh2wud8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19E65BD1273F84929F4F35E306C358F299A3EBC35AD35EB6E1690208D1D38A51D926B73
sha3_384: 2f4644af18237cdf4e803cf720eb8fb00b26cd12b452dad54517356490a0f933a0239e7d808638db159ff2ac73ae6b82
ep_bytes: e8c0030000e97afeffffc3558bec56ff
timestamp: 2021-07-22 01:16:22

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update
FileVersion: 1.3.147.37
InternalName: Microsoft Edge Update
LegalCopyright: Copyright Microsoft Corporation
OriginalFilename: msedgeupdate.dll
ProductName: Microsoft Edge Update
ProductVersion: 1.3.147.37
LanguageId: sr-Cyrl-RS
UpstreamVersion: 1.3.99.0
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.