Barys.2980 removal guide

The Barys.2980 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.2980 virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine Barys.2980?


File Info:
name: A7DC8A6CBB4313CE023D.mlw
path: /opt/CAPEv2/storage/binaries/0c82a9e38fc2e6d99c46eac69f7a1a46104e34f576cba075626a0dd689c3b041
crc32: 8967DAA4
md5: a7dc8a6cbb4313ce023d9bc5cefd5469
sha1: a07285a6aa04d3c8fe2c802558ee9d083c437eef
sha256: 0c82a9e38fc2e6d99c46eac69f7a1a46104e34f576cba075626a0dd689c3b041
sha512: 5aa3d299846a1ce31a0e42df06aa2b86d5d5edbbfdbc0b78e85a34845f816092005964cb92c9d3d7f9b3e29bf8367e194f00a93a49ade05a33a92a38402f5d5d
ssdeep: 49152:oWEJTw00I+83KMY2Bkrqx+rUcmbxjABhSaC:
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D395FB3439FE501AB173FF652EE8B9EAD9DEFB333606542D109203474622A41EE9253D
sha3_384: 696f1009a85293180abbdc6df58ebd707ec142fa205ecdd0277e87cb4c6a8e4513b643a532796fb56046ea03d93e6b55
ep_bytes: ff250020400000000000000000000000
timestamp: 2010-11-16 00:45:20

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 0.0.0.0
InternalName: Nexus Radio.exe
LegalCopyright:  
OriginalFilename: Nexus Radio.exe
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

Barys.2980 also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.lj8t
Elastic	malicious (high confidence)
FireEye	Generic.mg.a7dc8a6cbb4313ce
Skyhigh	BehavesLike.Win32.Dropper.tz
McAfee	Artemis!A7DC8A6CBB43
Cylance	unsafe
VIPRE	Gen:Variant.Barys.2980
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/Injector.dab057f6
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.CKF
APEX	Malicious
ClamAV	Win.Dropper.Barys-9873594-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.2980
NANO-Antivirus	Trojan.Win32.TrjGen.itfoe
MicroWorld-eScan	Gen:Variant.Barys.2980
Avast	Win32:RATX-gen [Trj]
Tencent	Win32.Trojan.Generic.Bdhl
Sophos	Mal/MSIL-BN
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.InjectNET.14
Zillya	Trojan.Genome.Win32.109369
Emsisoft	Gen:Variant.Barys.2980 (B)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Barys.2980
Jiangmin	Trojan/Genome.brtz
Webroot	W32.InfoStealerFignotok.A
Varist	W32/Risk.ZFBO-5530
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	Win32.Trojan.Generic.a
Xcitium	Malware@#2aphbtevdwn6o
Arcabit	Trojan.Barys.DBA4
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Fignotok.A
Google	Detected
ALYac	Gen:Variant.Barys.2980
MAX	malware (ai score=100)
Malwarebytes	Generic.Malware/Suspicious
Panda	Generic Malware
Rising	Malware.Obfus/MSIL@AI.81 (RDM.MSIL2:jnsFoDuTAfWiiPmb7vD7QA)
Ikarus	Virus.Win32.BeeInject
Fortinet	MSIL/Injector.PE!tr
BitDefenderTheta	AI:Packer.529BD58D20
AVG	Win32:RATX-gen [Trj]
Cybereason	malicious.6aa04d
DeepInstinct	MALICIOUS

How to remove Barys.2980?

Barys.2980 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X