Should I remove “Win32/Expiro.V”?

The Win32/Expiro.V is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Expiro.V virus can do?

• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Win32/Expiro.V?

File Info:
name: A7415425FD53A37EE669.mlw
path: /opt/CAPEv2/storage/binaries/20600c3bd725d32d3ff19bb9e862575e597868449bad19922981dfa391f32d88
crc32: 36719A7F
md5: a7415425fd53a37ee669378a2be20c96
sha1: f9485df56d34781166a5ee51710fd0cb5032fd8a
sha256: 20600c3bd725d32d3ff19bb9e862575e597868449bad19922981dfa391f32d88
sha512: 85798fb288c65262f3e55a777ce5c4b06e699ab7190724cb2ee7b2bef99957b3d5d0910d752e2d5a58aea2c03fe7916c9084498a5987c24f0a6b06da08c84d33
ssdeep: 3072:82kvcRj+omjgjHygjF/jbc2k1Y1GT+dYwxH//w8VdvVcGivOs:8sAwZk1Y1GPyFVBT9
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F2145B2537D81129F6B2727C183862B1D73878B46B3982CF977051DD69A7BF08B3538A
sha3_384: 0258b357c54889fbb94e4fc30d2cb8747e8a2f9956b58e2168974e5204c425c33e595f2c2b6eda7d0f7d1c4cd3c4033a
ep_bytes: 90605589e583ec60535657c745f80300
timestamp: 2008-04-13 18:32:08

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Performance Logs and Alerts Service
FileVersion: 5.1.2600.5512 (xpsp.080413-2108)
InternalName: SMLOGSVC.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SMLOGSVC.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.5512
Translation: 0x0409 0x04b0

Win32/Expiro.V also known as:

How to remove Win32/Expiro.V?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.