How to remove “Trojan:Win32/Barys.GMA!MTB”?

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Trojan:Win32/Barys.GMA!MTB?


File Info:
name: 395D40231D9941F5F52B.mlw
path: /opt/CAPEv2/storage/binaries/3a13e56f6cddaa011d76caf6add17c58a746281dbd88b44e6c6634c376a45fde
crc32: 9E268A8F
md5: 395d40231d9941f5f52bd5021159313a
sha1: 2bbef59397958bbd98e836f172fefb6042047e3b
sha256: 3a13e56f6cddaa011d76caf6add17c58a746281dbd88b44e6c6634c376a45fde
sha512: 84e9295022e6876d28a3dc53bba9e50809594d97258f0bd2eee187c075ac5185523e360695a6de5521e8e21e09407a9b42a14f43f739fcef7a27a4e23ca75074
ssdeep: 6144:SYZ6vzeQFZvLOxv7ppqxdSyfbjPDRXAit/o:BOpvLwvdYayfbj9XHZo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D824BFE6A3868B11D291027439535DB3B23FA29D133FA1E5B83DA85D0F7AF3191E25D0
sha3_384: 2fdcbba48c7860a96b8ba4eae221e8883ec2ac1ee3b597d1bdde94f394d7b7e00d27b895e645187b926edaeb0c108b09
ep_bytes: 5f1524110f4c90960a9da907c8dec1bd
timestamp: 1971-05-16 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.dc
McAfee	Trojan-FVOQ!395D40231D99
Cylance	unsafe
VIPRE	Gen:Variant.Lazy.439579
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0001b3411 )
K7GW	Trojan ( 00571ed01 )
Cybereason	malicious.397958
Arcabit	Trojan.Lazy.D6B51B
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik_AGen.BGV
APEX	Malicious
ClamAV	Win.Packed.Dridex-9861223-1
Kaspersky	HEUR:Trojan.Win32.Copak.pef
BitDefender	Gen:Variant.Lazy.439579
NANO-Antivirus	Trojan.Win32.Kryptik.foobtk
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
MicroWorld-eScan	Gen:Variant.Lazy.439579
Avast	Win32:Evo-gen [Trj]
Tencent	Trojan.Win32.Kryptik.gify
Emsisoft	Gen:Variant.Lazy.439579 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Siggen24.14501
Sophos	Mal/Inject-GJ
Ikarus	Trojan.Patched
Webroot	W32.Trojan.Gen
Varist	W32/Dacic.E.gen!Eldorado
Avira	TR/Dropper.Gen
Antiy-AVL	GrayWare/Win32.Kryptik.gifq
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.Kryptik.TLS@812zm8
Microsoft	Trojan:Win32/Barys.GMA!MTB
ZoneAlarm	HEUR:Trojan.Win32.Copak.pef
GData	Gen:Variant.Lazy.439579
Google	Detected
AhnLab-V3	Packed/Win.FJB.C5538060
BitDefenderTheta	Gen:NN.ZexaF.36680.n83@au6Updk
ALYac	Gen:Variant.Lazy.439579
TACHYON	Trojan/W32.Selfmod
VBA32	Trojan.Khalesi
Malwarebytes	Generic.Malware.AI.DDS
Panda	Trj/Genetic.gen
Rising	Trojan.Kryptik!1.B34D (CLASSIC)
Yandex	Trojan.Copak!5FC/nBuSdlI
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Kryptik.GIFQ!tr
AVG	Win32:Evo-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Trojan:Win32/Barys.GMA!MTB?

Trojan:Win32/Barys.GMA!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X