Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a virus message related to expamapi.dll in c:\Windows (windows xp). When I used ProcessExplorer, this dll is related to a bunch of processes, which isn't making sense. Some of the processes listed are:

  • explorer.exe
  • svchost.exe
  • MOM.exe
  • CTDVDDET.exe
  • CTSysVol.exe
  • DLLML.exe
  • Dropbox.exe

So, does this make sense? Or do I need to do some deep cleaning?

share|improve this question
are you 100% certain thats the file name ? the only google result for expamapi.dll is this page, which is really Odd... – Geraint Jones Sep 27 '10 at 4:29
Agreed - I was just about to post that exact question for Greg. – EEAA Sep 27 '10 at 4:36
Yeah, I'm sure. And this is what is causing me confusion as well...what the hell is this thing? That file is in the Windows folder and apparently associated with all of those processes, according to ProcessExplorer. – Greg McGuffey Sep 27 '10 at 14:27
up vote 0 down vote accepted

I posted a related question on the BitDefender forum and they confirmed that this is a malicious file. A deep scan removed it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.