Virus

About “Virus:Win32/Expiro.EK!MTB” infection

Malware Removal

The Virus:Win32/Expiro.EK!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win32/Expiro.EK!MTB virus can do?

  • Authenticode signature is invalid
  • CAPE detected the shellcode get eip malware family

How to determine Virus:Win32/Expiro.EK!MTB?



File Info:

name: CA8A78C78B4ED339465F.mlw
path: /opt/CAPEv2/storage/binaries/08d3434a80752bc74de27aef7cd68826a3d7d6c88c61b4b5b5ef095caa538c53
crc32: 8DD2EA0C
md5: ca8a78c78b4ed339465f4957ff5362a5
sha1: b5be7f4a0285212c9d05a0a9316e2d46c9582c52
sha256: 08d3434a80752bc74de27aef7cd68826a3d7d6c88c61b4b5b5ef095caa538c53
sha512: d44e2211069596f30815ba9c0d31f89ed7fddea997c180ebbd5aaa76cd709b0c1816d951a6c37db71031ac075fec35983be19134175f3828a5a2aa17e60186a8
ssdeep: 12288:WMCS8PEDlFpKfhEKKMj7G5D/5Uv4WSCYtTwR9Tq04eCP3sTah/LOT4yEqBZ:accf5jS5DxUvt1So9Tp/CfsnT1
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T191452313346C8823FA27BAB05A705561E57BF8709DB15B5BE7F0271F00B4E528C2BA67
sha3_384: 7ab97bc6e4bcfe27f69bb54b04b6ed347821c85e683e088c41faf4a107140574df21cde49111a567b5387a2ac88a55de
ep_bytes: e812030000e99efdffff558bec81ec28
timestamp: 2006-10-27 06:43:33


Version Info:

CompanyName: Microsoft Corporation
FileDescription: GrooveClean Utility
FileVersion: 12.0.4518.1014
InternalName: GrooveClean
LegalCopyright: © 2006 Microsoft Corporation.  All rights reserved.
OriginalFilename: GrooveClean.exe
ProductName: GrooveClean Utility
ProductVersion: 4.2.0.2623
SpecialBuild: 
Translation: 0x0000 0x04b0

Virus:Win32/Expiro.EK!MTB also known as:

BkavW32.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
AVGWin32:Vitro [Inf]
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Expiro.Gen.7
FireEyeGeneric.mg.ca8a78c78b4ed339
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win32.Expiro.tt
McAfeeArtemis!CA8A78C78B4E
Cylanceunsafe
SangforTrojan.Win32.Save.a
Cybereasonmalicious.78b4ed
SymantecW32.Xpiro.J!dam
ESET-NOD32a variant of Win32/Expiro.NDW
CynetMalicious (score: 100)
APEXMalicious
KasperskyVirus.Win32.Moiva.a
BitDefenderWin32.Expiro.Gen.7
NANO-AntivirusVirus.Win32.Virut-Gen.bwpxnc
AvastWin32:Vitro [Inf]
EmsisoftWin32.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin32.Expiro.Gen.7
TrendMicroVirus.Win32.EXPIRO.JMA
SophosW32/Moiva-A
IkarusTrojan.Patched
VaristW32/Expiro.AU.gen!Eldorado
AviraW32/Infector.Gen
Antiy-AVLVirus/Win32.Expiro.x
MicrosoftVirus:Win32/Expiro.EK!MTB
ArcabitWin32.Expiro.Gen.7
ZoneAlarmVirus.Win32.Moiva.a
GDataWin32.Expiro.Gen.7
GoogleDetected
Acronissuspicious
VBA32Trojan.Sabsik.TE
ALYacWin32.Expiro.Gen.7
MAXmalware (ai score=82)
MalwarebytesVirus.M0yv
PandaW32/Moyv.A
RisingTrojan.Generic@AI.90 (RDML:p2hQG+Y2xGWClVV698OhOg)
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW32/Expiro.NDP!tr
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Virus:Win32/Expiro.EK!MTB?

Virus:Win32/Expiro.EK!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment