Malware

Win64/Expiro.DH removal guide

Malware Removal

The Win64/Expiro.DH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win64/Expiro.DH virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Win64/Expiro.DH?



File Info:

name: D8F4DA79A9E6F8A8797E.mlw
path: /opt/CAPEv2/storage/binaries/5597511e8cd56fe4b9b333bd62f125ada4e1eb6ed98e2d013947b6a2d523d708
crc32: 207B410E
md5: d8f4da79a9e6f8a8797ef8ea372c10ac
sha1: ed1c052cbaf239d28afc0e0d385947f5c9613126
sha256: 5597511e8cd56fe4b9b333bd62f125ada4e1eb6ed98e2d013947b6a2d523d708
sha512: 61ddb0a25e9fc6f6129b92c0595dadc581e2224dd97e5b70c26e514b0a9310fc2b4ec55696ad18c7627eee05806f8382ad8a452471b275437a4997510f29f052
ssdeep: 6144:oNcxzHkyXnMr+AzMZ7vGXt6ZUojtx+mZ3RPiuf3A49wJADlDBYPAMShfW:njkyjxWwtx+mZ3hPf3A3JADlq
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T129C4D0ECD62424FCDC6F8C7471986368DE603A22231351D73E86851A9276EA7923CF5F
sha3_384: 4c41021243c3b3c98b5d11ad5835e2dcead191d99075a770c3d2f3e6ab9533f51abda4beb978660df7d405575573c177
ep_bytes: 4554415645574f29e44983c460654d8b
timestamp: 2006-03-07 20:13:24


Version Info:

CompanyName: Microsoft Corporation
FileDescription: Microsoft Distributed Transaction Coordinator Service
FileVersion: 2001.12.10941.16384 (WinBuild.160101.0800)
InternalName: MSDTC.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: MSDTC.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.1
Translation: 0x0409 0x04b0

Win64/Expiro.DH also known as:

MicroWorld-eScanWin64.Expiro.Gen.6
FireEyeGeneric.mg.d8f4da79a9e6f8a8
ALYacWin64.Expiro.Gen.6
CylanceUnsafe
VIPREWin64.Expiro.Gen.6
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
CyrenW64/Expiro.BE.gen!Eldorado
SymantecTrojan.Gen.MBT
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win64/Expiro.DH
APEXMalicious
BitDefenderWin64.Expiro.Gen.6
NANO-AntivirusVirus.Win64.Expiro.clnvwd
AvastWin64:Xpirat [Inf]
TencentWin64.Virus.Expiro.Vwhl
Ad-AwareWin64.Expiro.Gen.6
SophosML/PE-A
TrendMicroVirus.Win64.EXPIRO.MR
McAfee-GW-EditionBehavesLike.Win64.Expiro.hc
Trapminemalicious.high.ml.score
EmsisoftWin64.Expiro.Gen.6 (B)
SentinelOneStatic AI – Malicious PE
GDataWin64.Expiro.Gen.6
JiangminTrojan.Kryplod.oa
GoogleDetected
AviraTR/Patched.Gen
MAXmalware (ai score=81)
Antiy-AVLTrojan/Generic.ASVirus.32D
ArcabitWin64.Expiro.Gen.6
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 100)
Acronissuspicious
TrendMicro-HouseCallVirus.Win64.EXPIRO.MR
IkarusVirus.Win64.Expiro
FortinetW64/Expiro.CE
AVGWin64:Xpirat [Inf]
Cybereasonmalicious.cbaf23

How to remove Win64/Expiro.DH?

Win64/Expiro.DH removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment