About “Barys.62606” infection

The Barys.62606 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.62606 virus can do?

Behavioural detection: Executable code extraction – unpacking
Authenticode signature is invalid

How to determine Barys.62606?


File Info:
name: 997957A049BEA8F6E242.mlw
path: /opt/CAPEv2/storage/binaries/3702026d9d5e3191022e48c2b537562b57b30b1953c06e83d207d756d0dcb6ad
crc32: 1EF4EB75
md5: 997957a049bea8f6e242c2d057be851a
sha1: f55e5470fcd5a0ad124f4d11af3d11e8167e2ba1
sha256: 3702026d9d5e3191022e48c2b537562b57b30b1953c06e83d207d756d0dcb6ad
sha512: 716ac38fd7f46678c8e6b2f2a09f33bea56d56152f7a9520ea41c5548127e8bf5c4eb90e7459a2aa3b596b8e669d6037279f92435b2f9e04f8f1aa236ec63cfc
ssdeep: 3072:BqxcC0U7fiQUShCXJSiNitKV+dUHhRF9014ulGQeHmsXIN8hXiuSKB1ZHWTeZYZx:JT4ShRF9ulG0sYNOpBrW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17D74063E28BD062BC9B4C6B5CFE68537F020E96B31122A3A98D357594757E4329C353E
sha3_384: ea46d365401b60d2996853244011480d0144ae558a3c4176a6cb63d9c7b00019e9769efea3f10c96fa50048434c0092b
ep_bytes: 6850144000e8eeffffff000000000000
timestamp: 2011-09-19 17:18:27

Version Info:
Translation: 0x0409 0x04b0
Comments: SiDENYSwLfyRMB
CompanyName: PqecVolHdCHE
FileDescription: AMbIa
LegalCopyright: gQkuedQC
ProductName: fJQVmqskJZQBjlF
FileVersion: 1.00
ProductVersion: 1.00
InternalName: windows
OriginalFilename: windows.pif

Barys.62606 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Botnetlog.2088
MicroWorld-eScan	Gen:Variant.Barys.62606
FireEye	Generic.mg.997957a049bea8f6
Skyhigh	Generic VB.fl
ALYac	Gen:Variant.Barys.62606
Malwarebytes	Remtasu.Spyware.Stealer.DDS
VIPRE	Gen:Variant.Barys.62606
Sangfor	Suspicious.Win32.Save.vb
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Barys.62606
BitDefenderTheta	Gen:NN.ZevbaF.36792.wm0@aux09cji
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Remtasu.J
APEX	Malicious
ClamAV	Win.Trojan.Spyeye-7591981-0
Kaspersky	Trojan.Win32.VBKrypt.vini
Alibaba	Trojan:Win32/VBKrypt.2c51c040
NANO-Antivirus	Trojan.Win32.VB.gxecu
Rising	Malware.Undefined!8.C (TFE:5:AhSVPtRnhZJ)
Sophos	Troj/VB-JHN
Google	Detected
F-Secure	Trojan.TR/Dropper.Gen
Zillya	Trojan.Remtasu.Win32.5400
Trapmine	suspicious.low.ml.score
Emsisoft	Gen:Variant.Barys.62606 (B)
Ikarus	Trojan.Win32.Zmunik
Webroot	W32.Malware.Gen
Varist	W32/VBInject.AZ.gen!Eldorado
Avira	TR/Dropper.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Backdoor]/Win32.Bredolab
Kingsoft	Win32.Trojan.Generic.a
Microsoft	VirTool:Win32/VBInject.RT
Xcitium	Malware@#2lpuaeuxei11v
Arcabit	Trojan.Barys.DF48E
ZoneAlarm	Trojan.Win32.VBKrypt.vini
GData	Gen:Variant.Barys.62606
Cynet	Malicious (score: 99)
McAfee	Generic VB.fl
DeepInstinct	MALICIOUS
VBA32	Trojan.VB.Levelup
Cylance	unsafe
Panda	Generic Malware
Tencent	Win32.Trojan.Vbkrypt.Fdhl
Yandex	Trojan.Remtasu!AtopPHoO420
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.2588.susgen
Fortinet	W32/VBObfus.C!tr
AVG	Win32:GenMalicious-KLD [Trj]
Cybereason	malicious.0fcd5a
Avast	Win32:GenMalicious-KLD [Trj]

How to remove Barys.62606?

Barys.62606 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X