I recommend you UnHackMe - Ultimate Malware Killer for fast malware removal:
Download UnHackMe
Fully Functional 30-day Trial. No credit card is required. Reviews. EULA. Privacy Policy.
LIBEXPAT.DLL – Unclassified Malware removal
LIBEXPAT.DLL size: 684032 bytes
LIBEXPAT.DLL hash: 430C0F9AE8DEE52AAFA950E05B7BD9EA
Created files:
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\atl71.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\atl90.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\dl_peer_id.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\libexpat.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\libpng13.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\minizip.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\mini_unzip_dll.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\msvcp71.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\msvcp90.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\msvcr71.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\msvcr90.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\SetupReal.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\SetupUI.cab
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\SetupXar.xar
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\startmenu.vbs
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\taskbar.vbs
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLBugHandler.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLBugReport.exe
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLFSIO.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLGraphic.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLGraphicPlus.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLLuaRuntime.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLUE.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLUEIPC.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLUEOPC.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XLUEOPS.exe
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XMPPush.exe
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XmpSetupAgent.exe
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\XmpSetupProxy.dll
%TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\zlib1.dll
Detected by UnHackMe:
LIBEXPAT.DLL
Default location: %TEMP%\F79D5311C7DC9D4A45B50A92B60485CD\4.9.13.1955\LIBEXPAT.DLL
Dropper information:
MD5: f79d5311c7dc9d4a45b50a92b60485cd
File size: 56739720 bytes