Virus

About “Virus:Win64/Expiro.DD!MTB” infection

Malware Removal

The Virus:Win64/Expiro.DD!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Virus:Win64/Expiro.DD!MTB virus can do?

  • Authenticode signature is invalid

How to determine Virus:Win64/Expiro.DD!MTB?



File Info:

name: 8C7E77A059F598614069.mlw
path: /opt/CAPEv2/storage/binaries/139a9e3154ea07f77e7fa42bbc0f55a8a257b8d4265b5f6386e1b07face35ab1
crc32: 418A5FC7
md5: 8c7e77a059f598614069f158c519238d
sha1: 7c0cae68c9b6125cec25fc53ddf2ea921fe7db1a
sha256: 139a9e3154ea07f77e7fa42bbc0f55a8a257b8d4265b5f6386e1b07face35ab1
sha512: ca9dc6ebf0c5219ca208f2e960808eba18981aad080adde21112e128c72b19a9c357025966d7a2386010ba2abc7cbfe89579e773290e7a0b961c62a558af069d
ssdeep: 24576:vhbHjP9ssv/sBpmpMRajtfIUNJ4IHmu1DnynQfq:vhbHjFssv/CpmpMgjtrrhDyQi
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T10155016E6AAD21E4F172E67C99A58006E331BC291725A3FF2795823D0F379E51C38F41
sha3_384: 4a669ef75e6da3497c33cf5eafb1ffa7f33fa1b56af8550c4d82a6054e11dbd6717b1afd23b112e4679e12072b86b75e
ep_bytes: 4883ec28e8179d09004883c428e95efe
timestamp: 1985-11-23 07:56:19


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Microsoft (R) Diagnostics Hub Standard Collector
FileVersion: 11.00.19041.928 (WinBuild.160101.0800)
InternalName: DiagnosticsHub.StandardCollector.Service.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: DiagnosticsHub.StandardCollector.Service.exe
ProductName: Internet Explorer
ProductVersion: 11.00.19041.928
Translation: 0x0409 0x04b0

Virus:Win64/Expiro.DD!MTB also known as:

BkavW64.AIDetectMalware
LionicVirus.Win32.Expiro.n!c
Elasticmalicious (high confidence)
MicroWorld-eScanWin64.Expiro.Gen.7
FireEyeWin64.Expiro.Gen.7
CAT-QuickHealW32.Expiro.R3
SkyhighBehavesLike.Win64.Expiro.tt
McAfeeArtemis!8C7E77A059F5
Cylanceunsafe
SangforSuspicious.Win32.Save.a
K7AntiVirusVirus ( 0058d9c51 )
K7GWVirus ( 0058d9c51 )
Cybereasonmalicious.059f59
VirITWin64.Expiro.AJ
SymantecW64.Xpiro.J!dam
ESET-NOD32a variant of Win64/Expiro.CV
APEXMalicious
AvastWin64:Expiro-AJ [Inf]
KasperskyVirus.Win64.Moiva.a
BitDefenderWin64.Expiro.Gen.7
NANO-AntivirusVirus.Win64.Virut-Gen.bwpxnc
RisingVirus.Expiro!1.A140 (CLASSIC)
EmsisoftWin64.Expiro.Gen.7 (B)
F-SecureMalware.W32/Infector.Gen
DrWebWin32.Expiro.158
VIPREWin64.Expiro.Gen.7
TrendMicroVirus.Win64.EXPIRO.SMAJC
SophosW64/Moiva-B
IkarusVirus.Win64.Expiro
ALYacWin64.Expiro.Gen.7
VaristW64/Expiro.AR.gen!Eldorado
AviraW32/Infector.Gen
MAXmalware (ai score=87)
Antiy-AVLVirus/Win64.Expiro.ce
MicrosoftVirus:Win64/Expiro.DD!MTB
ArcabitWin64.Expiro.Gen.7
ZoneAlarmVirus.Win64.Moiva.a
GDataWin64.Expiro.Gen.7
CynetMalicious (score: 100)
AhnLab-V3Virus/Win.Expiro.X2221
Acronissuspicious
GoogleDetected
TACHYONVirus/W64.Movia
MalwarebytesVirus.M0yv
PandaW64/Moyv.A
TencentVirus.Win64.VirMoiva.a
SentinelOneStatic AI – Suspicious PE
MaxSecureTrojan.Malware.121218.susgen
FortinetW64/Expiro.CV
AVGWin64:Expiro-AJ [Inf]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (D)
alibabacloudVirus:Win/Expiro.CV(dyn)

How to remove Virus:Win64/Expiro.DD!MTB?

Virus:Win64/Expiro.DD!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment