Virus

How to remove “Virus:Win32/Expiro.EK!MTB”?

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • Unconventionial language used in binary resources: Arabic (Saudi Arabia)
  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: EE358EC3BC994DD9F1BF.mlw
path: /opt/CAPEv2/storage/binaries/a24794886162a4e4c7c3ffa6c32ed727f2830fa27fd940bee8ff1b5e4b64a6c9
crc32: 15E6A2D7
md5: ee358ec3bc994dd9f1bfa11e853a55e9
sha1: a8d514b7024ce9c0a96ca7de500067fb2cd2898b
sha256: a24794886162a4e4c7c3ffa6c32ed727f2830fa27fd940bee8ff1b5e4b64a6c9
sha512: 0cd6b88b2c635c47a59cc931ca4d7545272a2b9b4f1ea145b486377fb1504df0839c93fa7b97531d191f8a3e4c1f5bd4a546fdc7600790dafd5637a28a857ffc
ssdeep: 12288:pGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPhi:Mt/sBlDqgZQd6XKtiMJYiPUi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14155231E64C7D09AC67F1E362DA97800E27B371CAE497097A5C6B75D9E3E01309B9233
sha3_384: 0ffcb4e1df6a66fe05623aea88ae849af71b354787cf90a0b7857977cf47619557ff6cade7eb2e1f0e784b93f3bfad16
ep_bytes: e82dfcffffe936fdffff538a5c2408f6
timestamp: 2006-10-27 02:48:57


Version Info:

CompanyName: Microsoft Corporation
FileDescription: 2007 Microsoft Office component
FileVersion: 12.0.4518.1014
InternalName: SetLang
LegalCopyright: © 2006 Microsoft Corporation.  All rights reserved.
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: SetLang.Exe
ProductName: 2007 Microsoft Office system
ProductVersion: 12.0.4518.1014
Translation: 0x0000 0x04e4

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
FireEyeGeneric.mg.ee358ec3bc994dd9
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Generic.tt
McAfeeArtemis!EE358EC3BC99
MalwarebytesGeneric.Malware/Suspicious
VIPREWin32.Expiro.Gen.7
SangforSuspicious.Win32.Save.a
K7AntiVirusVirus ( 005a8b911 )
K7GWVirus ( 005a8b911 )
CrowdStrikewin/malicious_confidence_100% (W)
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDP
APEXMalicious
ClamAVWin.Malware.Expiro-9941636-0
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
MicroWorld-eScanWin32.Expiro.Gen.7
AvastWin32:FileInfector-C [Heur]
TencentVirus.Win32.VirMoiva.a
TACHYONVirus/W32.Movia
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
TrendMicroVirus.Win32.EXPIRO.JMA
Trapminesuspicious.low.ml.score
SophosW32/Moiva-A
IkarusWin32.Sality
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
MicrosoftVirus:Win32/Expiro.EK!MTB
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
GoogleDetected
Acronissuspicious
ALYacWin32.Expiro.Gen.7
MAXmalware (ai score=85)
VBA32Trojan.Sabsik.TE
Cylanceunsafe
PandaW32/Moyv.A
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
AVGWin32:FileInfector-C [Heur]
Cybereasonmalicious.7024ce
DeepInstinctMALICIOUS

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment