Should I remove “Virus:Win32/Expiro.EK!MTB”?

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Detects Bochs through the presence of a registry key
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?

File Info:
name: CD55CF350073CFC35022.mlw
path: /opt/CAPEv2/storage/binaries/8f5a4864102558c3561e54523166bf8b5e2735ba337c1f2c5426018694a6a552
crc32: 8B0001A9
md5: cd55cf350073cfc35022e45e4243e9e5
sha1: 489c63ede673247391809dde4ce5c9355678a041
sha256: 8f5a4864102558c3561e54523166bf8b5e2735ba337c1f2c5426018694a6a552
sha512: af1073beb634585ae685a4b282104f483ab67f80a03abba29c6ba9b185a6df9ac597cbcd1426a38a39196c6a20bbf6badc7d20ad481dc90d247dea9bf4b7f870
ssdeep: 24576:+GBebZjEbhoncndLxdmo+eXEVT3wvUzO:TebCh0cJrmemTgvC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EE85F17137ECC8B3F263063544B98A6AD5F67C83AD31815F63E46B0EDA366914A32713
sha3_384: 1d62b8b39473bf0596cc1ed9577605ed46125b7d0cdb1b1a7bf37318d43a18362861ac5ac32f2bbe78a928ff5b8f6dd4
ep_bytes: e8a44d0000e916feffff8b542404568b
timestamp: 2006-10-27 06:54:56

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Groove Migrator Utility
FileVersion: 0004, 0002, 0000, 0000
InternalName: GrooveMigrator
LegalCopyright: Copyright © 2006 Microsoft Corporation.  All rights reserved.
OriginalFilename: GrooveMigrator.exe
ProductName: Groove Migrator Utility
ProductVersion: 0004, 0002, 0000, 0000
Translation: 0x0000 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

How to remove Virus:Win32/Expiro.EK!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.