What is “Barys.948”?

The Barys.948 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Barys.948 virus can do?

Authenticode signature is invalid

How to determine Barys.948?


File Info:
name: AB3051727131B75D113D.mlw
path: /opt/CAPEv2/storage/binaries/aca79fffc8517ca5b4dd8888c118e6d2d7988796dff538354b959d6ca06202fe
crc32: 7C549E34
md5: ab3051727131b75d113d942640676892
sha1: 52618f89acfca549fe6637b7d9abe1be3b99007a
sha256: aca79fffc8517ca5b4dd8888c118e6d2d7988796dff538354b959d6ca06202fe
sha512: ac49c2569c3a1588031e23bc79ca426a2937ec80df5b347665a6f3c28f328687455cc9302deab0f9a848bc13df77ae199e6c7f24eed1e459159cff1aed5f5a91
ssdeep: 1536:AMiw1iFAE+/Dc3CJQ3DXgLtxkWPtEYreRQtuAyU1rC:A1qFGOeRQtHyUhC
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T1CAA36D013C97C1B3D049497F85C287D16BBF2D03BBE6A4EFFF5406895AA02C16A796B1
sha3_384: f9e90a3927412ee4570fed0d342781987f3f5ce2156c7c17ee4c1e422d6836b4f505e5f7f22dea136ae5b61e0a70429e
ep_bytes: 837c2408017505e8ff5a0000ff742404
timestamp: 2009-12-09 07:58:26

Version Info:
0: [No Data]

Barys.948 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Barys.948
ClamAV	Win.Trojan.Downloader-3779
FireEye	Generic.mg.ab3051727131b75d
McAfee	Downloader-CFE
Zillya	Trojan.Brownsid.Win32.10
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	Trojan:Win32/Brownsid.f4bcf614
K7GW	Trojan ( 004ca6d51 )
K7AntiVirus	Trojan ( 004ca6d51 )
Arcabit	Trojan.Barys.948
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Brownsid.D
Cynet	Malicious (score: 99)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Barys.948
NANO-Antivirus	Trojan.Win32.Agent.egpvt
Avast	Win32:TrojanX-gen [Trj]
Rising	Downloader.Agent!8.B23 (TFE:6:hlHXs0gOlrD)
Emsisoft	Gen:Variant.Barys.948 (B)
F-Secure	Heuristic.HEUR/AGEN.1301889
DrWeb	Trojan.DownLoader5.22969
VIPRE	Gen:Variant.Barys.948
Sophos	Mal/Generic-S
Ikarus	Trojan-Dropper.Win32.Agent
Jiangmin	Trojan/Generic.rxvf
Webroot	W32.Malware.Downloader
Google	Detected
Avira	HEUR/AGEN.1301889
Antiy-AVL	Trojan/Win32.AGeneric
Kingsoft	Win32.Trojan.Generic.a
Xcitium	Malware@#3ovkk1eh51ilk
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Barys.948
Varist	W32/Risk.VFFE-3059
BitDefenderTheta	Gen:NN.ZedlaF.36744.gu4@aKmXpshi
ALYac	Trojan.Downloader.Agent.serv
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Download
Cylance	unsafe
Panda	Generic Malware
Tencent	Win32.Trojan.Generic.Timw
Yandex	Trojan.GenAsa!g4nbA0dmSdQ
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.1521242.susgen
Fortinet	W32/CFE!tr.dldr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove Barys.948?

Barys.948 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X