Should I remove “Win32.Expiro.DF (B)”?

The Win32.Expiro.DF (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32.Expiro.DF (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• At least one process apparently crashed during execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Anomalous file deletion behavior detected (10+)
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Likely virus infection of existing system binary
• Attempts to bypass application whitelisting by executing .NET utility in a suspended state, potentially for injection

How to determine Win32.Expiro.DF (B)?

File Info:
name: 4A66141FBB955778113F.mlw
path: /opt/CAPEv2/storage/binaries/f797377b5473f24e528eb923cee54be00427b5e0e9537000d279961ed66c9772
crc32: F35B70F6
md5: 4a66141fbb955778113fd2a50b757773
sha1: 9873c035ecfabcf68aa3d000efe9f7d60fb505e2
sha256: f797377b5473f24e528eb923cee54be00427b5e0e9537000d279961ed66c9772
sha512: 95c14f774e880742701ee2001f5526fd4cf5367c1b5b659ac309f6ef77436fb08515a19f5a9ad9f3b375adfc5e6be3fb6217d4451445470c717a2cf22464a24f
ssdeep: 12288:rcFUPn7UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8X:rcFUP7atr0zAiX90z/F0jsFB3SQkU
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A3551202728690B6F8F319B18A7C4C5A162DBE71239691DBB2C53E0F59F46D27D313A3
sha3_384: 0a65b5f8b3fc7fb8a456d1febbd0893cfd60c49be9d36a4c89d946ce513c3e56398554598861e6fca3ede51b05414039
ep_bytes: e8c39b0900e937fdffffcccc689d8440
timestamp: 2019-09-11 06:08:52

Version Info:
CompanyName: Adobe Systems
FileDescription: Adobe Acrobat Update Service
FileVersion: 1.824.35.0289
InternalName: armsvc.exe
LegalCopyright: Copyright © 2019 Adobe Systems.  All rights reserved.
OriginalFilename: armsvc.exe
ProductName: Adobe Acrobat Update Service
ProductVersion: 1.824.35.0289
Translation: 0x0409 0x04b0

Win32.Expiro.DF (B) also known as:

How to remove Win32.Expiro.DF (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.