Should I remove “Barys.213901”?

The Barys.213901 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.213901 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Created a process from a suspicious location

How to determine Barys.213901?

File Info:
name: 1AB8CFF1C031F8E649CF.mlw
path: /opt/CAPEv2/storage/binaries/7471f73eaba391db7e8298b1954cfaff87ae7a0f18f303d9050c933a0cee7a90
crc32: 97139960
md5: 1ab8cff1c031f8e649cf727483c0442f
sha1: cb53e81be1340ccf7cf0fddc2f4bdfd757127dba
sha256: 7471f73eaba391db7e8298b1954cfaff87ae7a0f18f303d9050c933a0cee7a90
sha512: 37335ca5fd5a73e4631c7c017129ce9c9fdff0432b36a08db0acba9d8c853851ae6f5fe17a4b55fd48a7ba270730cc9ba905dff7d2aaec1daa947b9d339b7c81
ssdeep: 1536:gMXLDV6QCMkYa+DMFuElXd7GKbBQimo0xR/2A4GbVfgnouy8/O:3LB637Y7MdltSGQie2uZQout
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T16D830285A9CB5B7AC03B42BECB2C4E56F928431E564137677CE6E47B6E14A4C5C283C3
sha3_384: 7fcb4a47a1d9bf525893cc0e0cedbc0254cc51fe0ff7dfc8f9cd3f084fa8eb2bed40250053d5bdddf837db825d94ecc9
ep_bytes: 60be15f040008dbeeb1fffff5789e58d
timestamp: 2016-05-27 14:05:09

Version Info:
0: [No Data]

Barys.213901 also known as:

How to remove Barys.213901?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.