What is “Barys.859”?

The Barys.859 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.859 virus can do?

Executable code extraction
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Barys.859?


File Info:
crc32: 4B6717F0
md5: 2baee3fbb82d6e55a59c23a9fa8c71ac
name: 2BAEE3FBB82D6E55A59C23A9FA8C71AC.mlw
sha1: c608338754ba731465bd52ad0c60df6cfd012606
sha256: 46252bdccf6464b62c12c2f99598baa8877d53b255ca19c874e867ff259ab33c
sha512: 3f58333a3f918281c18aa2c76aef24d3ff4236e60fa819c6f1b44377d127d244590eab0bf65235b3e540c011f7b4f6381c13331affd2d3f987ec8e1d9be8a282
ssdeep: 384:MnmTb4Z1AVjfC+aUB+Ni10O85KGOSL0UdrrxsrY:MnmTg1ujfC+arq185KGOSYUVG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
LegalCopyright: radyofm
InternalName: ddd
FileVersion: 6.05.0004
CompanyName: radyofm
LegalTrademarks: radyofm
Comments: radyofm
ProductName: radyofm
ProductVersion: 6.05.0004
FileDescription: radyofm
OriginalFilename: ddd.exe

Barys.859 also known as:

Bkav	W32.AIDetect.malware2
K7AntiVirus	Trojan ( 004cc7751 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Barys.859
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (W)
BitDefender	Gen:Variant.Barys.859
K7GW	Trojan ( 004cc7751 )
Cybereason	malicious.bb82d6
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.ELF
APEX	Malicious
Kaspersky	UDS:Worm.Multi.GenericML.xnet
MicroWorld-eScan	Gen:Variant.Barys.859
Ad-Aware	Gen:Variant.Barys.859
BitDefenderTheta	AI:Packer.B4ADC1BF1F
VIPRE	LooksLike.Win32.Beebone.a (v)
TrendMicro	TROJ_GEN.R005C0WFG21
McAfee-GW-Edition	BehavesLike.Win32.Trojan.nz
FireEye	Generic.mg.2baee3fbb82d6e55
Emsisoft	Gen:Variant.Barys.859 (B)
SentinelOne	Static AI – Suspicious PE
Avira	TR/Dropper.Gen
eGambit	Unsafe.AI_Score_99%
Microsoft	Program:Win32/Wacapew.C!ml
GData	Gen:Variant.Barys.859
McAfee	Artemis!2BAEE3FBB82D
MAX	malware (ai score=81)
VBA32	Malware-Cryptor.VB.gen.1
Malwarebytes	Malware.AI.73317865
TrendMicro-HouseCall	TROJ_GEN.R005C0WFG21
Ikarus	Trojan.Win32.Injector
Fortinet	W32/Injector.CRKZ!tr

How to remove Barys.859?

Barys.859 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X