About “Barys.431091 (B)” infection

The Barys.431091 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Barys.431091 (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Barys.431091 (B)?

File Info:
name: A9810BEAC1DA29A606FB.mlw
path: /opt/CAPEv2/storage/binaries/5ab6b0703dad51fe5bb7c711cfaafd468572f99e06f639af1d43a33f7e5b301c
crc32: 2140C0E2
md5: a9810beac1da29a606fb200e706400c9
sha1: d1f166e07a4dd0fcf30a6756eb98b5324b31d217
sha256: 5ab6b0703dad51fe5bb7c711cfaafd468572f99e06f639af1d43a33f7e5b301c
sha512: 24aa99155e9ddf98d4a6346576cfaa95b715d83b0c8441c8786bbbc8813146d5b7b0abc157849be15b6b882e5f811ae3ca2f2cfbac1da3ebd040d34c6c02ed80
ssdeep: 6144:9ptf01DifkpJFhSpe/+Ij7NweeJEKlJ85eg/0ISDhfq:9pt8RisJXKIj3e6Rvd/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T179242F54B38099BBF4B18DFAA7A50353009C5D38A9C57213F3C99B1A3579CE682707EB
sha3_384: 5f517cc89ccef77c1dd3465a6432033d714da6064e50720b2b563898be51a8685e5ef55870a089393e01511189055977
ep_bytes: 68d03d4000e8f0ffffff000000000000
timestamp: 2011-03-04 03:50:08

Version Info:
Translation: 0x0409 0x04b0
ProductName: ZSyPhNICRLuadOfCoF
FileVersion: 9.95
ProductVersion: 9.95
InternalName: lDGakgWn
OriginalFilename: lDGakgWn.exe

Barys.431091 (B) also known as:

How to remove Barys.431091 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.