Virus:Win32/Expiro.R

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

Virus:Win32/Expiro.R is the detection for a virus that infects EXE files in all drives and collects user credentials from an infected computer. It also allows backdoor access and control to the infected computer, and lowers Internet Explorer settings.

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

For more information on antivirus software, see http://www.microsoft.com/windows/antivirus-partners/.

Additional remediation instructions for Virus:Win32/Expiro

This threat may make lasting changes to a computer's configuration that are NOT restored by detecting and removing this threat. For more information on returning an infected computer to its pre-infected state, please see the following article/s:

Configuring Security Zone settings for Internet Explorer:

For Windows 7: http://windows.microsoft.com/en-us/Windows7/Change-Internet-Explorer-Security-settings
For Internet Explorer 7 and 8 in Windows Vista: http://windows.microsoft.com/en-us/windows-vista/Change-Internet-Explorer-Security-settings
For Internet Explorer 6: http://support.microsoft.com/kb/174360

For other support and help related articles, go to:

Windows 7: http://support.microsoft.com/gp/windows7
Windows Vista: http://support.microsoft.com/ph/11732
Windows XP: http://support.microsoft.com/ph/1173

Microsoft Security TechNet Center: http://technet.microsoft.com/security/default.aspx

Virus:Win32/Expiro.R

Summary

What to do now

Additional remediation instructions for Virus:Win32/Expiro

Technical information

Threat behavior

Installation

Spreads via...

Payload

Prevention

Symptoms

System changes