About “Win32/Expiro.CY” infection

The Win32/Expiro.CY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Expiro.CY virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Expiro.CY?


File Info:
name: B8AEFE6413584D0104B4.mlw
path: /opt/CAPEv2/storage/binaries/f9612cd6b0aba2c6187270da36bb4668242cfff9957ec81f50242d2a147369da
crc32: 116CC082
md5: b8aefe6413584d0104b4ad5a98a1e86b
sha1: d0a270b22c0a0099e78fb453e8cecce01550af7b
sha256: f9612cd6b0aba2c6187270da36bb4668242cfff9957ec81f50242d2a147369da
sha512: a41789ff8c6625504eff88f45e76a7c5d4aae1b22e94526052eea7150a0336826cc49872c4e7e3bf6d9cea8be6b9932f76d1c307a55810c6c1d7ef5cec677e10
ssdeep: 12288:PKyXc3ajG+hjQKymY8efKCpD7Gj9G6GlqT8nQkCu83L3Wl/np9DBDt3kbE:PKysqjnhMgeiCl7G0XehbGZpbD
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T13645237FA60C91A7D95248BA83E8F01D581B7F569B1004C3AE977CBEE2F54E44F38066
sha3_384: 4333f3a7e987894f10213f13dab961a05e93396d9ec7943c245604c4eb4290435302733a43ada06431ba1df1e9f22ebc
ep_bytes: e90a280000e9991e0000e9441d0000e9
timestamp: 2016-08-08 19:09:27

Version Info:
0: [No Data]

Win32/Expiro.CY also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Generic.mg.b8aefe6413584d01
ALYac	Win32.Expiro.Gen.7
Cylance	Unsafe
K7AntiVirus	Virus ( 0058c9f71 )
K7GW	Virus ( 0058c9f71 )
Cyren	W32/Expiro.AU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Expiro.CY
APEX	Malicious
Kaspersky	Virus.Win32.Moiva.a
BitDefender	Win32.Expiro.Gen.7
NANO-Antivirus	Virus.Win32.Virut-Gen.bwpxnc
Avast	Win32:Evo-gen [Susp]
Ad-Aware	Win32.Expiro.Gen.7
Sophos	ML/PE-A
DrWeb	Win32.Expiro.153
Emsisoft	Win32.Expiro.Gen.7 (B)
GData	Win32.Expiro.Gen.7
Jiangmin	Trojan.Generic.herau
Avira	W32/Infector.Gen
Antiy-AVL	Trojan/Generic.ASVirus.316
Microsoft	Trojan:Script/Phonzy.C!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.R482093
MAX	malware (ai score=80)
VBA32	SScope.Trojan.Zbot.gen
Rising	Trojan.Generic@AI.77 (RDMK:cmRtazpvGb1dKof2x2btWbzffz+X)
Ikarus	Virus.Win32.Expiro
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Expiro.NDO!tr
AVG	Win32:Evo-gen [Susp]
Panda	W32/Moyv.A

How to remove Win32/Expiro.CY?

Win32/Expiro.CY removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X