Should I remove “Trojan:Win32/Barys.GMA!MTB”?

The Trojan:Win32/Barys.GMA!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Barys.GMA!MTB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode get eip malware family
• Creates a copy of itself
• Deletes executed files from disk
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Barys.GMA!MTB?

File Info:
name: 0901FD106EBBBD02C2FD.mlw
path: /opt/CAPEv2/storage/binaries/906ffda10e8003809d9b8a96bb483480b53da4c54499031559bbf2e8f85d8edd
crc32: DB98F702
md5: 0901fd106ebbbd02c2fd91192c58c29c
sha1: ce76132351e9732f3d43d922d67a80d83444a109
sha256: 906ffda10e8003809d9b8a96bb483480b53da4c54499031559bbf2e8f85d8edd
sha512: f13f4f9dc8f20d0b32e3ed4e1b7adfc252bdcfe91ba5adc0b3ef97176d26aec1a4fa6d8d1bfe190537552f6f4b90e3ab2ff7e68988b85e725b9a68a8fde223a1
ssdeep: 12288:1U5r+sQtBGaOdj6Mbl8EEB+dv6y10Nstgk0npM4dl0v5JHpS0wULVnMhysFjm+0y:WCaaOzJgkEM4dmv5Xf+hPEM4dmv52e
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA05DFE2B74C5EE9C8B9333F162D7341AB939D2A6939605F24ACC36B0957D3B414F212
sha3_384: 87a88728d6b093ca95280e224bc84c1a2081dd71a8dc5a45ac89a58da2c80fd121307de13f29f76267e3d143afdf29c9
ep_bytes: 6241f752321843d537c97a44f58a12fe
timestamp: 1971-05-16 00:00:00

Version Info:
CompanyName: Wayne J. Radburn
FileDescription: PE/COFF File Viewer
FileVersion: 0.9.9.0
InternalName: PEview
LegalCopyright: Copyright© 1997-2011 Wayne J. Radburn
OriginalFilename: PEview.exe
ProductName: PEview
ProductVersion: 0.9.9.0
Translation: 0x0409 0x04e4

Trojan:Win32/Barys.GMA!MTB also known as:

How to remove Trojan:Win32/Barys.GMA!MTB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.