Virus:Win32/Expiro.EK!MTB removal tips

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Expiro.EK!MTB?


File Info:
name: F153879D2EF69406136E.mlw
path: /opt/CAPEv2/storage/binaries/c5222ea37c63a16eb3869d51b68b8fcdc8b6a1bdea9404ae4e5f02cca301a687
crc32: 17B87051
md5: f153879d2ef69406136e95e10894af9b
sha1: d4624bb78aedc286250fb196a25dca76aa45ba31
sha256: c5222ea37c63a16eb3869d51b68b8fcdc8b6a1bdea9404ae4e5f02cca301a687
sha512: e685301c8107d50b19aedd74c0f3f1a76746fcae376ec3af631dc72294877ad3d545d656db3bcb18e086e7da56ab63cb4141ef2618b09976f3a75530379af799
ssdeep: 12288:ZL6XL579rkVitLP5izLMQqUt4MK5z8YwwN44Ix2:ZLegmLP5ilqkK18Yw/x
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DC756D2F62224C65F0DBB07CCD59C9D60805AC6F81554E465579BB0AE2B3ECB3C0DEEA
sha3_384: 96f2aef6514c76514b57b6f83e32895e456cdf5aa65883723793647b52c867121bf2f03ae27c600dd1a6ea0b79f8649f
ep_bytes: 56e8bffeffff8bf085f6741de8679e0d
timestamp: 2017-03-01 00:06:02

Version Info:
CompanyName: Adobe Systems Inc.
FileDescription: Adobe AIR Application Installer
FileVersion: 25.0.0.134
InternalName: AIRAppInstaller.exe
LegalCopyright: Copyright 2007-2017, Adobe Systems Inc.
OriginalFilename: AIRAppInstaller.exe
ProductName: Adobe AIR 
ProductVersion: 25.0
Translation: 0x0409 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Win32.Expiro.158
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.f153879d2ef69406
CAT-QuickHeal	W32.Expiro.R3
Skyhigh	BehavesLike.Win32.Generic.tt
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Virus ( 0059041f1 )
K7GW	Virus ( 0059041f1 )
CrowdStrike	win/malicious_confidence_100% (D)
Symantec	W32.Xpiro.J!dam
ESET-NOD32	a variant of Win32/Expiro.DM
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	Virus.Win32.Moiva.a
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:FileInfector-C [Heur]
Tencent	Virus.Win32.VirMoiva.a
Sophos	W32/Moiva-A
F-Secure	Malware.W32/Infector.Gen
VIPRE	Win32.Expiro.Gen.7
TrendMicro	Virus.Win32.EXPIRO.JMA
Emsisoft	Win32.Expiro.Gen.7 (B)
SentinelOne	Static AI – Malicious PE
GData	Win32.Expiro.Gen.7
Google	Detected
Avira	W32/Infector.Gen
MAX	malware (ai score=84)
Kingsoft	malware.kb.a.888
Arcabit	Win32.Expiro.Gen.7
ZoneAlarm	Virus.Win32.Moiva.a
Microsoft	Virus:Win32/Expiro.EK!MTB
Varist	W32/Expiro.AU.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5383452
ALYac	Win32.Expiro.Gen.7
TACHYON	Virus/W32.Movia
Cylance	unsafe
Panda	W32/Moyv.A
Rising	Trojan.Generic@AI.94 (RDML:SeY89n/xtodmujsrW8Qp9Q)
Ikarus	Virus.Win32.Expiro
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Expiro.NDP!tr
AVG	Win32:FileInfector-C [Heur]

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X