How to remove “Win32/Expiro.DA”?

The Win32/Expiro.DA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Expiro.DA virus can do?

Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32/Expiro.DA?


File Info:
name: 73CA6CD0593DFF771BC4.mlw
path: /opt/CAPEv2/storage/binaries/6f63569a6fd619728195fd10057ccb82d99fc9a7f0a35bb2840363a418ba63fe
crc32: 7EEE2EA9
md5: 73ca6cd0593dff771bc453d926df7564
sha1: 82efc36d4b5b30adf843f34fcc5ffbd8ed98964f
sha256: 6f63569a6fd619728195fd10057ccb82d99fc9a7f0a35bb2840363a418ba63fe
sha512: 2a52ec9020d72e969afe87d5a501d17cc9c1242d0a868eae86a0d85bcc18a2e4cfaddfa311718e78f06d3ad35e377bea3607432f642dcadefc6f6422e33426ff
ssdeep: 98304:arNDN7/OT+aNZkj/Wd1t18NuZHwKyzHecclG1lp8ajYqW3ophsRqfUO2HCZTdM+Z:aNlOSaNZkjuzv5n0f3zXW3ophsRqf+C+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C33633919485416CC1EE233C17BC7FDB34E4AC754E9EC0E7D042B591DA7A2B8D8AE722
sha3_384: 8752e7900f123c05fbc9edfef5e1fa937eb0fb26341e79f56e9b37642518944311b07b85a728791130f42aedec391041
ep_bytes: e926faffff8b442404eb1780f93b750c
timestamp: 2005-02-24 19:44:38

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Self-Extracting Cabinet
FileVersion: 6.1.0022.4 (SRV03_QFE.031113-0918)
InternalName: SFXCAB.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SFXCAB.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.0022.4
Translation: 0x0409 0x04b0

Win32/Expiro.DA also known as:

MicroWorld-eScan	Win32.Expiro.Gen.7
FireEye	Win32.Expiro.Gen.7
CAT-QuickHeal	W32.Expiro.H5
McAfee	Artemis!73CA6CD0593D
Cylance	Unsafe
VIPRE	Win32.Expiro.Gen.7
BitDefender	Win32.Expiro.Gen.7
Cybereason	malicious.d4b5b3
Cyren	W32/Expiro.AU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Expiro.DA
APEX	Malicious
Kaspersky	Virus.Win32.Moiva.a
Cynet	Malicious (score: 100)
Ad-Aware	Win32.Expiro.Gen.7
TACHYON	Virus/W32.Movia
DrWeb	Win32.Expiro.153
McAfee-GW-Edition	BehavesLike.Win32.BadFile.rc
Trapmine	malicious.high.ml.score
Emsisoft	Win32.Expiro.Gen.7 (B)
Ikarus	Trojan.Patched
Microsoft	Trojan:Script/Phonzy.C!ml
GData	Win32.Virus.Patched.M@susp
Google	Detected
VBA32	Trojan.Sabsik.TE
ALYac	Win32.Expiro.Gen.7
MAX	malware (ai score=85)
Malwarebytes	Malware.Heuristic.1001
Panda	W32/Moyv.A
Tencent	Virus.Win32.VirMoiva.a
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Expiro.NDP!tr

How to remove Win32/Expiro.DA?

Win32/Expiro.DA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X